Hello sorry if this is a silly question and do say if this would be more suitable for a software stack-exchange but after a lot of googling I've still not found anything suitable, so starting to worry that there might be problems with this design?

I am looking to encrypt some data in a database so the data is safe if an attacker had direct access to the database or took a copy of the database, after some research reached the conclusion that encrypting database side would be problematic due to exposing keys to the one place the really should be kept away from. The new design is to encrypt application side using a OpenSSL library, to be able to use salts and limit the scope of a single keys I discovered that a KDF is ideal for this.

My latest design is a key micro-service that my applications make an api call with their salt (and something to identify which current/past master key was used, to help with key rotation) which provides the scope/context of what data they need, and if they are looking for a crypt key, an auth key or an index key, and the api will respond with the derived key. This is good because I can log which applications are requesting access to which table columns/rows.

Instead of implementing a key service that is able to generate, rotate, and provide derived keys in a secure and reliable manner, this feels generic enough that there might be an open source off the shelf solution that manages such a task? However I am unable to find one. This leads me to speculate that either:

  • I'm using the wrong terminology
  • the solution is small enough nobody has thought to look for one
  • or there is a fundamental flaw with the design of such a system

If it matters I'm looking to encrypt the data with AES, and use PBKDF2 for the KDF, although those choices aren't set in stone and just need to be easily available across technologies. One benefit of key rotation is so we could rotate to different algorithms if necessary.

  • $\begingroup$ Could you be looking for public-key encryption? What it does is that it allow anyone to encrypt using a public key, and an "escrow" service in posession of the private key can decrypt the data upon authenticating the source of the decryption request. $\endgroup$
    – DannyNiu
    Nov 24, 2023 at 13:53
  • $\begingroup$ Have you heard of Kerberos? It's a symmetric-key network security service. Your use of KDFs reminds me of it. $\endgroup$
    – DannyNiu
    Nov 24, 2023 at 13:59
  • $\begingroup$ I don't think I need asymmetric crypto any of the internal applications that need to access a encrypted column-row will need read and write access. I gather asymmetry adds complications and is slower and generally asymmetry is mainly used to safely pass a symmetric key between two parties? Good idea though I will have a look. $\endgroup$
    – Alex Dawn
    Nov 24, 2023 at 14:02
  • $\begingroup$ Kerberos, looks interesting I'll take a look $\endgroup$
    – Alex Dawn
    Nov 24, 2023 at 14:05

1 Answer 1


Thanks to the commenters I was able to carry on searching with better terms and came across the hashicorp vault that does work with KDFs:


The source is available and thankfully the licence is permissive enough for what I need.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.