On Tue, Nov 17, 2009 at 10:12 PM, Naoko Reeves <na...@lawlogix.com> wrote: > Hi, > > We have web application and encrypt PII columns. We use encrypt/decrypt > function for this. > > Currently we hard coded the key in postgresql function which I am not sure > of it. > > I did google it and people suggest that it needed to be stored in physically > isolated location (storing decryption key on the same server as the data is > kind of like writing your PIN on your ATM card).
Key management is a complicated topic, but I can tell you this for sure: storing the key in the function is one of the worst places to do it :-) Any user can pull down the entire pg_proc table and see all your functions! (this is somewhat fixable, but It's still not the right place IMO). merlin -- Sent via pgsql-general mailing list (pgsql-general@postgresql.org) To make changes to your subscription: http://www.postgresql.org/mailpref/pgsql-general
