-1

The title maybe it's a little bit confusing but I am certain that what I want to achieve is a common pattern, even if I didn't found anything on internet.

I'm developing a web app that store encrypted critical user data in a database, through server. User must be able to see decrypted data every time access the app. Nothing of innovative.

What is the best way to store data and retrieve them without inserting every time the secret key for the encryption/decryption in a secure way?

Is there's a way to do that without hard coding the secret key in the client-side?

Improve this question
3
  • 3
    Why don't you establish an HTTPS connection to transfer your data to the client? The data will still be secure, and you can do whatever you like in the way of encryption/decryption server-side.
    – Robert Harvey
    Aug 7, 2019 at 23:20
  • Encryption is meant to obscure information from those not meant to see it. So the really important question is who between the database stored on the Harddrive of the server and the client can see that data? Can other programs on the DB server? (DB engines can encrypt there own databases). Can the DB engine see it? (The server or client can encrypt). What about the web server? What about the network? (use HTTPS). You'll probably find that as long as the connections between client/webserver/db and the db file itself is encrypted you are fine.
    – Kain0_0
    Aug 8, 2019 at 0:35
  • @RobertHarvey Yes the HTTPS connections will be implemented after for prevent attacks in the client-server communications. What i want to achieve is that the server store the data of the client in an encrypted way and when client request the data the server returns them and the client decrypt them, but without entering the secret key for decryption each time or hard-code the secret key in the client. Or i am missing something?
    – damianobellucci
    Aug 8, 2019 at 6:26

1 Answer 1

Reset to default
0

Multiple ways to skin the cat! Depends if you want to utilize Encryption capabilities within a DB, or application (server-side) encryption capabilities before persisting in DB.

  1. Some vendors provide encryption add-ons, modules that allow you to configure (including the keys) the DB to keep all data at rest in encrypted form.

  2. Alternatively, you can implement encryption through a services layer wherein as data from client browsers (preferably on https channel) comes to the service, it encrypts it using some well established algorithm and then saves it within the database. Using this approach, you'd have in the application/web server, control over the encryption / decryption keys and how frequently you'd access them, preferably at initialization.

Some points to remember, each approach has its positives and negatives, most important of these is the protection of your keys.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.