5 ms·
We have an encryption scheme where all user data has its own unique user based key. So compromising 1 user key only lets you have access to that user data and t
by reza_n 9y ago
We have an encryption scheme where all user data has its own unique user based key. So compromising 1 user key only lets you have access to that user data and that key has access to nothing else. Your statement is correct when you said that automated systems which need access to all data will inevitably lead to mass decryption and compromise. In the system described above, there is no way for an automated system (or anything) to have access to all keys and therefor no system or person can access all data.
- kabdib 9y agoHow does this help if you've got an API that decrypts for you? It's possible that you've protected the data at rest, but if some 'get' operation is just going to serve it up, what is the effective difference?
- reza_n 9y agoThe get operation provides parts of the key used to decrypt the data you are after. No key, no data. Edit: the key comes from the user, its not stored anywhere on a server. The key can optionally never leave the user's device.
- rhizome 9y agoIf someone drains your db, do they get the keys along with it?
- vehementi 9y agoNo, of course you would not store those keys in that database.
- kabdib 9y agoI guess you can have a key-per-row, or key-per-partition, and throttle and monitor access to that key. This isn't going to make operations like database indexing or joins very happy, so you're probably limited to payload-level data; hard to judge if that's okay since I don't know the requirements for the schema. This presupposes you know what you're doing, security-wise, on your network, and with your backups, and with temporary data on servers. All of your interior traffic is encrypted, right? Right. It doesn't sound like Equifax was even on the map.
- usaphp 9y ago> Edit: the key comes from the user, its not stored anywhere on a server. The key can optionally never leave the user's device. Does it mean if user loses his key - he wont be able to get access to his data?
- SomeStupidPoint 9y agoYou may have rate monitoring on the decryption requests, watching the traffic flow to the servers fronting your encrypted store. An attacker is forced to either exfiltrate the data slowly (so the surge isn't noticed) or alert ops monitoring that the decryption service is unusually active. Defense in depth raises the difficulty in going unnoticed and raises the time it takes to succeed.
- SAI_Peregrinus 9y agoRemember that the users in this case are the banks. Their data wasn't what got leaked. Product data got leaked.