patspam has asked for the wisdom of the Perl Monks concerning the following question:
Dear monks,
Pity my CPAN/Google-fu, but I'm finding Perl database encryption resources to be very few and far between. Can any monks shine some light here?
By database encryption I'm talking about the use of symmetric keys to store encrypted data in a db (not ssl communication with a db). I've been reading Kevin Kenan's book "Cryptology in the database" (Symantec Press) which presents a fairly thorough architecture (including Cryptographic Engine, Key Vault/Manifest/Manager, Crypto Provider/Consumer) with a sample implementation in Java.
I understand that a local software-based key store is going to have to essentially rely on obfuscation to protect the master encryption key (Kenan advocates the use of key-encrypting keys split into at least 2 files to makes things at least non-trivial for an attacker) so I suppose implementing a cryptosystem architecture in code (as opposed to in an external tamper-proof hardware device) isn't all that appealing - still I'm surprised the CPAN doesn't contain any attempts at implementing a working system..? (or maybe I just haven't found it yet..)
I'm sure many of the monks here have worked on projects where the database required encryption (medical info, credit card details, etc..) so I'd really love to hear how you approached the problem.
Regards,
Patrick Donelan
Pity my CPAN/Google-fu, but I'm finding Perl database encryption resources to be very few and far between. Can any monks shine some light here?
By database encryption I'm talking about the use of symmetric keys to store encrypted data in a db (not ssl communication with a db). I've been reading Kevin Kenan's book "Cryptology in the database" (Symantec Press) which presents a fairly thorough architecture (including Cryptographic Engine, Key Vault/Manifest/Manager, Crypto Provider/Consumer) with a sample implementation in Java.
I understand that a local software-based key store is going to have to essentially rely on obfuscation to protect the master encryption key (Kenan advocates the use of key-encrypting keys split into at least 2 files to makes things at least non-trivial for an attacker) so I suppose implementing a cryptosystem architecture in code (as opposed to in an external tamper-proof hardware device) isn't all that appealing - still I'm surprised the CPAN doesn't contain any attempts at implementing a working system..? (or maybe I just haven't found it yet..)
I'm sure many of the monks here have worked on projects where the database required encryption (medical info, credit card details, etc..) so I'd really love to hear how you approached the problem.
Regards,
Patrick Donelan
Back to
Seekers of Perl Wisdom