I have a chatting application like Slack/Discord. In this chat application there chat groups and messages sent by users need to be encrypted in the database. I do not need features like E2E encryption, I only need to encrypt these data for legal purposes & database issues like SQL injection.

I plan to use a simple symmetry key encryption on the backend server. When storing/querying messages, perform application-level encryption/decryption on the messages.

Question is how do I handle what secret key to use?

Method 1: Global secret key (can be stored in another microservice)

Method 2:secret key for each chat group (generated when the group is created, stored in db)

Method 3: Use some information like the chatgroup_id as a secret key

My main question is, is having multiple secret key more secure than having a global key? Any purpose of having multiple secret key in my use-case?

  • $\begingroup$ How worried are you that a single global key could leak vs leaking dedicated per-group secret keys? (Also as method 4 you could use a central key and derive a per-group key based on fixed group metadata like the group id using eg HKDF) $\endgroup$
    – SEJPM
    Apr 21 '20 at 18:27
  • 1
    $\begingroup$ This is more of an aside, but you shouldn't be relying on encryption to protect against SQL injection. $\endgroup$ Apr 21 '20 at 18:36
  • $\begingroup$ @SEJPM I guess that the main point for considering whether to use a global key. For that method, you mean we could derive another key using group_id? Should I store this key in the database as well, computing this key for each query seems too expensive $\endgroup$
    – Kaka you
    Apr 22 '20 at 2:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.