2009/6/17 Peter Gore <PGore@...>:

> Hi,
>
> I encrypt data in my application and store data in FB. I then have a Stored
> Procedure do decrypt the data enabling queries to be run OK. The stored
> procedure require a KEY that is external to the database.

And it's a piece of cake to retrieve this KEY. Network protocol
sniffing, replacing your database with a dummy-stored-procedure that
stores the input-key, etc.

Many questions that have been asked in this thread have already been
answered in this document from Geoff Worboys (which I'm wonder he did
not already mention):

http://www.firebirdsql.org/manual/fbmetasecur.html

Basically, having that kind of encryption that the database content
itself is encrypted *securely* (that is, it's not security by
obscurity), is practically not possible.
That's the sad truth.

Kind regards,

Daniel Albuschat

--
eat(this); // delicious suicide