Here's a good article, Keith Brown on the problem and challenges of storing "secrets" on a device - http://pluralsight.com/wiki/default.aspx/Keith.GuideBook/HowToStoreSecretsOnAMachine.html
With security, I think it is important that you understand the threats and risks and how this software is used in your enterprise. If by database you mean an RDBMS, some of the newer one's provide column level encryption in tables (you may have to consider other issues including deployment, administration and recovery of systems in case of disasters). Depending on how the software is used it may also be possible to store the key on a removable device that is handled securely and have the key provided as needed for encryption/decryption. Also have you looked at other data stores for this kind of data? If your primary platform is Microsoft based, you may want to look at ADAM for storing certain kinds of information and take advantages provided there. There are no silver bullets to engineering problems, but it has defense in depth. Randhir Vayalambrone "I thought I had tunnel vision, until I met people who lived in a vicious tunnel!" ----- Original Message ---- From: Saqib Ali <[EMAIL PROTECTED]> To: Davie Elliott <[EMAIL PROTECTED]> Cc: [email protected] Sent: Friday, June 16, 2006 12:33:22 PM Subject: Re: Securing an encryption key within software. without understanding the use, and confidentiality requirements of your system, the only thing I can suggest is the use of TPM. Trusted Platform Module 1.2 is a hardware chip comes with most of the recent computers. The TPM can bind your encryption key, such that they keys are tied to a particular TPM. Since each TPM has a unique root key, the wrapped application encryption keys, can not be decrypted on any other computer. Generate a unique AES encryption key for each installation of your software, Wrap/bind that key with the wrapping key from the TPM, and place the wrapped AES key on the hard drive. Whenever you need to access your encrypted data, read the encrypted AES key from the hard drive and get it is decrypted by the TPM, and use the decrypted key to decrypt other. So now your application is tied to particular computer. If somebody steals the AES key from the computer, and try to decipher or some other computer, they won't be able to. To further secure this implement, you can probably use cryptographic ASIC or HSM to perform the encryption, so that the CPU never sees the decrypted AES key. -- Saqib Ali, CISSP, ISSAP Support http://www.capital-punishment.net ----------- "I fear, if I rebel against my Lord, the retribution of an Awful Day (The Day of Resurrection)" Al-Quran 6:15 ----------- --------------------------------------------------------------------------- --------------------------------------------------------------------------- --------------------------------------------------------------------------- ---------------------------------------------------------------------------
