CODEWITHSUNDEEP
encryptionaes
Shrijan Tiwari
Shrijan Tiwari

Reputation: 693

Generate Passphrase for Encryption

I am working on Encrypting some data using AES 128bit encryption algorithm (Symmetric Encryption Algorithm).

Problem I am facing with this is generating a Key ? As I have mutliple Users and I don't want to share the common key across the users.

Is there is any possibility to generate passphrase in such a way that it is not common to all and can be passed to AES to decrypt/Encrypt the same data?

Example: lets assume I have a table with employee and their salary. I want to encrypt Salary Column of Employee with AES encryption.

Now when Someone authorized from HR wants to see the salary of Employee they can check, but they should have their own Key (not the common Key).

Upvotes: 0

Views: 711

Answers (2)

gusto2
gusto2

Reputation: 12075

Now when Someone authorized from HR wants to see the salary of Employee they can check, but they should have their own Key (not the common Key).

Using symmetric encryption - effectively there is only a single data encryption key (DEK). The DEK can be random and content specific. You cannot have multiple keys to decrypt the same encrypted content.

What is commonly done using asymmetric encryption, when someone authorizes (shares/assigns) an encrypted content to a user, the DEK is re-encrypted by the user's public key, so only an authorized user could decrypt the DEK and then content (though - the DEK is the same for all users).

when user logs in I will ask them Key

To log in the user anyway needs to provide a secret (its user password or other credentials), so - do you really need to go through all the hustle? Isn't enough to encrypt data at REST with some system-specific master key and provide the encrypted content only to an authenticated and authorized user?

Upvotes: 0

Bart Friederichs
Bart Friederichs

Reputation: 33491

One possible solution is to create an encrypted version of the master key per user.

So you will:

  1. Encrypt your data with a "master key"
  2. Encrypt your "master key" with a "personal key" (one for each user)

Then, when a user provides its personal key, you use it to decrypt the stored and encrypted master key, and then use that to decrypt the data. This way the encryption for the data can be done with always the same key, and you can regulate access with the personal keys.

This assumes though the master key and encrypted data never leave the server, you will have to decrypt on the server and send unencrypted to the user (but of course use a secure line for that, against eavesdropping).

There is no way to do this if you want to send the data to the user encrypted.

Upvotes: 1

Related Questions