[WEB SECURITY] Encrypting Client Data

Justin Scott leviathan at darktech.org
Sat Jun 11 22:30:28 EDT 2011

> The database information is now secure and you only
> need to protect the encryption keys at the application
> layer - which is a completely different conversation...

Precisely, their proposed model does exactly what you said, and their
method for storing the keys is, well, not to store them; just pass the
key off to the end-user and have them keep it stored on their end and
provide them to the application when needed.  The people who want the
application built are very risk-averse and don't trust the keys to be
stored anywhere that the server/application/staff has direct access to
them.  Personally, I'd prefer a more standard key management system
but the thought of us even having both the encrypted data and the keys
makes the business very, very nervous.  Eventually the data and keys
have to come together, so there is always some risk, they just want it
to be as reduced as possible and still get the application built.


More information about the websecurity mailing list