kaczy27 wrote:

> > http://riste.softver.org.mk/downloads/database_encryption.pdf
> By accident this the subject of my master thesis.
>
> The paper is pretty general marking some (certainly not all) risks
> to databases security. Also it lacks the solutions, which are
> probably some commercial products. Is there anything more to read on
> this subject - something more specific? I tried to browse the page
> you listed, but unfortunatelly I am not russianspeak able.

That's my personal web page(in Macedonian) and it doesn't contain any
specifics about database encryption. I only used my web space to upload
the document I used to read on that topic. I only pointed out some of
the ideas I used at my company (since me and Lee J. are obviously in the
same business), that is storing hashes of the values that we needed to
be indexed (searchable). But for storing credit card numbers it's not
that convinient to store a pure hash of the card no since the set of
values is fairly limited so it is pretty easy to exhaust the set of
values. It's far better suffix the card no (or any other data within a
limited set of values) with DB encryption key so if an attacker get's
his hands on the data he won't be able to get the source values without
the DB encryption key used. The real problem with this system is the
storage of the DB encryption key. If an attacker compromises the system
it will be easy to get access to the DB ecnryption key also, so the
ultimate secure solution would be to use an HSM (Hardware Security
Module) under whose MasterKey the data would be encrypted/hashed.

regards,

--
Riste Pejov
Card Management System
National Payment Card
Kuzman Josifovski Pitu br.1
tel:++ 389 2 3293 826
Skopje, MKD
http://www.npk.com.mk