Got it. Thank you very much for your advice. -----Original Message----- From: Merlin Moncure [mailto:mmoncure@xxxxxxxxx] Sent: Tuesday, November 17, 2009 8:54 PM To: Naoko Reeves Cc: pgsql-general@xxxxxxxxxxxxxx Subject: Re: Where do you store key for encryption On Tue, Nov 17, 2009 at 10:12 PM, Naoko Reeves <naoko@xxxxxxxxxxxx> wrote: > Hi, > > We have web application and encrypt PII columns. We use encrypt/decrypt > function for this. > > Currently we hard coded the key in postgresql function which I am not sure > of it. > > I did google it and people suggest that it needed to be stored in physically > isolated location (storing decryption key on the same server as the data is > kind of like writing your PIN on your ATM card). Key management is a complicated topic, but I can tell you this for sure: storing the key in the function is one of the worst places to do it :-) Any user can pull down the entire pg_proc table and see all your functions! (this is somewhat fixable, but It's still not the right place IMO). merlin -- Sent via pgsql-general mailing list (pgsql-general@xxxxxxxxxxxxxx) To make changes to your subscription: http://www.postgresql.org/mailpref/pgsql-general
