Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How to encrypt data in a SQL database?

news.ycombinator.com

Post reply on HN
Print view View original

11–20 of 31 posts

Re: Ask HN: How to encrypt data in a SQL database?

#11

Post by AnEro »

deidei wrote: post #7
comprev wrote: post #3

Look into something like HashiCorp's Vault for storing sensitive data. Trying to roll your own is asking for trouble!

Thanks for the reply. I'm fully aware of the dangers of rolling my own and want to avoid it at all costs. Is using a battle-tested Node.js library or the database's own API for encryption also dangerous?

As I understand it, it's more scaling the company and managing the keys does become an issue if you handle those directly. Imagine explaining this stuff now to a junior dev lol. As for a database's own encryption, I would trust it as much as you trust the organization programming that database.

I manage keys with Azure since we are a Microsoft hybrid house.

Re: Ask HN: How to encrypt data in a SQL database?

#13

Post by deidei »

goralph wrote: post #10

If you’re using a cloud provider like AWS I’d recommend their dedicated solutions for this problem - for AWS it’s Secrets Manager

It would be better to store all the Client Secrets in such a Secrets Manager right? Or should I create an encryption key per user and store that in the Secrets Manager?

Re: Ask HN: How to encrypt data in a SQL database?

#14

Post by deidei »

AnEro wrote: post #11
deidei wrote: post #7

Earlier quoted context omitted.

Thanks for the reply. I'm fully aware of the dangers of rolling my own and want to avoid it at all costs. Is using a battle-tested Node.js library or the database's own API for encryption also dangerous?

As I understand it, it's more scaling the company and managing the keys does become an issue if you handle those directly. Imagine explaining this stuff now to a junior dev lol. As for a database's own encryption, I would trust it as much as you trust the organization programming that database. I manage keys with Azure since we are a Microsoft hybrid house.

That does make sense, thanks. Do you store all the secrets using the Key Vault?

Re: Ask HN: How to encrypt data in a SQL database?

#15

Post by chrismeller »

deidei wrote: post #13
goralph wrote: post #10

If you’re using a cloud provider like AWS I’d recommend their dedicated solutions for this problem - for AWS it’s Secrets Manager

It would be better to store all the Client Secrets in such a Secrets Manager right? Or should I create an encryption key per user and store that in the Secrets Manager?

Best practice is to do envelope encryption where you encrypt the data with one key, then you encrypt that key with another (hence envelope). That allows you to routinely rotate the outer key without having to laboriously re-encrypt the actual data.

Whether you use one envelope key or one data key per client, one data key for all, or one envelope key for all is really a judgement call and depends on how paranoid you want to be vs. how much you want to worry about juggling keys.

Personally I don’t go per-user, but if you have the concept of a company/tenant/etc. I might do one for each of those. If you’re storing each tenant in a different database or region it lends itself more towards having a separate key for each as well.

Re: Ask HN: How to encrypt data in a SQL database?

#16

Post by NoThisIsMe »

deidei wrote: post #7
comprev wrote: post #3

Look into something like HashiCorp's Vault for storing sensitive data. Trying to roll your own is asking for trouble!

Thanks for the reply. I'm fully aware of the dangers of rolling my own and want to avoid it at all costs. Is using a battle-tested Node.js library or the database's own API for encryption also dangerous?

No, that's fine. I'd shy away from third party libs though, would probably use what Node.js provides out of the box. Or possibly something in the database, but I've never looked into that. Just don't roll your own crypto _library_, obviously.

Re: Ask HN: How to encrypt data in a SQL database?

#17

Post by NoThisIsMe »

comprev wrote: post #3

Look into something like HashiCorp's Vault for storing sensitive data. Trying to roll your own is asking for trouble!

This would be an atypical use case for Vault AFAIK. My understanding is it's intended for sensitive config-like data, not sensitive app data.

Re: Ask HN: How to encrypt data in a SQL database?

#18

Post by AnEro »

deidei wrote: post #14
AnEro wrote: post #11

Earlier quoted context omitted.

As I understand it, it's more scaling the company and managing the keys does become an issue if you handle those directly. Imagine explaining this stuff now to a junior dev lol. As for a database's own encryption, I would trust it as much as you trust the organization programming that database. I manage keys with Azure since we are a Microsoft hybrid house.

That does make sense, thanks. Do you store all the secrets using the Key Vault?

Yep!
Post reply on HN