The discussion generally follows this pattern:

1. Obfuscation is a waste of everyone's time. If we're going to make
it secure, we should make it secure.
2. It would be simple and straightforward to do page level encryption
if there were a satisfactory strategy for key management. The
nasty problem is that the encryption key is required to start a
server, long before a user checks in.
3. Any mechanism that purports to hide the database encryption key on
the host system is insecure unless the drive itself is encrypted.
4. If the drive is encrypted, database level encryption is unnecessary.

If you have a solution to the key management problem, the rest is
trivial. If you don't, the rest is probably impossible.

On 11/3/2010 6:56 AM, sijun_kang wrote:
> It seems that "database encryption" was a topic previously discussed long time ago and it was concluded that encryption would not be more secure than obfustication in some scenarios. But still, I think there are other scenarios where encryption is the only methold to help secure the data. Since there are already some code (currently disabled) in the source, I wonder why it has never been released as a feature to the public? As mentioned in ticket "CORE-1913" (Firebird Core - Database encryption revisited, http://tracker.firebirdsql.org/browse/CORE-1913), in some applications, even the law requires encryption as a must-have. I wish this feature be made active as soon as possible. Any comment/insight on this? Thanks
>
>
>
> ------------------------------------
>
> Yahoo! Groups Links
>
>
>
>


--
Jim Starkey
Founder, NimbusDB, Inc.
978 526-1376



[Non-text portions of this message have been removed]