Re: Where to keep encryption key , DB?

In comp.security.misc NetComrade <andreyNSPAM_at_bookexchange.net> wrote:
> We are planning to store credit card #'s in our database..

> We are looking into different options to encrypt CC #'s, one is to use
> oracle's built in dbms_obfuscation_toolkit.

> The question is, where do we store the encryption key?

> I thought of creating a separate account in the db just to hold that
> function, and just grant execute on it to a user that needs to execute
> it, but not see the code of the function.. The thing is, if you grant
> execute to userB, userB's all_source can see the source of the
> function..

> How woud you do it? (or did you already)

The better method is : Don't try to obfuscate credit card info. MOVE IT to a safe server.

If a machine is exposed to Internet ( or other security hazards) it's unwize to have any sensitive information on-line.

An alternate method could be to encrypt it with a public-key mechanism, where the encryption is done with the public key and the private key is totally absent from this computer.

> If we are to store the key in let's say some C code, that we'd have to
> redploy our application each time we are changing the key..

Security has very often implications. There is no such thing as free security.

> BTW, what are the general industry standards to change the key (how
> often, etc, etc)

"general industry standards" is close to non-existent in this area.

> Any help is greatly appreciated.
> .......
> We use Oracle 8.1.6-8.1.7 on Solaris 2.6, 2.7 boxes
> Andrey Dmitriev eFax: (978) 383-5892 Daytime: (917) 750-3630
> AOL: NetComrade ICQ: 11340726 remove NSPAM to email

-- 
Peter Håkanson         
        IPSec  Sverige      (At the Riverside of Gothenburg, home of Volvo)
           Sorry about my e-mail address, but i'm trying to keep spam out.
	   Remove "icke-reklam"and "invalid"  and it works.