Hello sorry if this is a silly question and do say if this would be more suitable for a software stack-exchange but after a lot of googling I've still not found anything suitable, so starting to worry that there might be problems with this design?
I am looking to encrypt some data in a database so the data is safe if an attacker had direct access to the database or took a copy of the database, after some research reached the conclusion that encrypting database side would be problematic due to exposing keys to the one place the really should be kept away from. The new design is to encrypt application side using a OpenSSL library, to be able to use salts and limit the scope of a single keys I discovered that a KDF is ideal for this.
My latest design is a key micro-service that my applications make an api call with their salt (and something to identify which current/past master key was used, to help with key rotation) which provides the scope/context of what data they need, and if they are looking for a crypt key, an auth key or an index key, and the api will respond with the derived key. This is good because I can log which applications are requesting access to which table columns/rows.
Instead of implementing a key service that is able to generate, rotate, and provide derived keys in a secure and reliable manner, this feels generic enough that there might be an open source off the shelf solution that manages such a task? However I am unable to find one. This leads me to speculate that either:
- I'm using the wrong terminology
- the solution is small enough nobody has thought to look for one
- or there is a fundamental flaw with the design of such a system
If it matters I'm looking to encrypt the data with AES, and use PBKDF2 for the KDF, although those choices aren't set in stone and just need to be easily available across technologies. One benefit of key rotation is so we could rotate to different algorithms if necessary.