Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an idea for a SaaS product I want to create, however, this product will store extremely sensitive data that needs to be encrypted at rest. The trouble is not so much the encryption, but the problem of securely storing the keys so that in the event the server was somehow compromised, the keys couldn't just be recovered and used to decrypt the database.

Are there any decent books to guides regarding database encryption, and in particular secure key storage? This seems to be a less than straightforward topic and something that is difficult to get right. I'm seeing multiple ways to attack such a system, but unable to come up with one that is secure enough to store highly confidential information.

share|improve this question

closed as not constructive by Oded, Robert Harvey, Walter, Bill the Lizard, Yannis Apr 5 '12 at 17:27

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

What database are you using? Oracle, for example, has native support for encrypting data at rest as part of Transparent Data Encryption (TDE) where it can store the decryption key in the server's Hardware Security Module (HSM) which takes care of secure storage for you. Potentially, you could also deploy servers that have self-encrypting hard drives though that may get rather expensive if you scale up. If you need to implement the functionality yourself, that's obviously much more difficult. – Justin Cave Apr 4 '12 at 22:26
@JustinCave Preferably Postgresql or MySQL in a pinch. – Matty Apr 4 '12 at 22:31
up vote 1 down vote accepted

The bible is Applied Cryptography by Bruce Schneier, however, I suggest starting with "Secrets and Lies" and "Beyond Fear".

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.