I have a chatting application like Slack/Discord. In this chat application there chat groups and messages sent by users need to be encrypted in the database. I do not need features like E2E encryption, I only need to encrypt these data for legal purposes & database issues like SQL injection.
I plan to use a simple symmetry key encryption on the backend server. When storing/querying messages, perform application-level encryption/decryption on the messages.
Question is how do I handle what secret key to use?
Method 1: Global secret key (can be stored in another microservice) Method 2:secret key for each chat group (generated when the group is created, stored in db) Method 3: Use some information like the chatgroup_id as a secret key
My main question is, is having multiple secret key more secure than having a global key? Any purpose of having multiple secret key in my use-case?