Re: New types for transparent encryption

Andrew Dunstan wrote:
>
>
> Andrew Chernow wrote:
>>
>>> Encrypting lots of small chunks of data with the same key is a very
>>> dangerous thing to do and it's very tricky to get right.
>>
>> Using an initialization vector (IV) is the way to go, recommend using
>> CBC or CFB mode. Although, an IV is never supposed to be used more
>> than once with the same key; that can leak hints about the plaintext.
>> Where is the randomly generated IV stored for use during decryption?
>
> Well, you can store it along with the encrypted data. The IV doesn't
> need to be secret, just random. I do that for one of my clients.
>

That's correct. Duh!?! Probably the first N bytes of the cipher text.

Would the IV be regenerated every time the plaintext is updated, to avoid using
it twice? For instace: update t set text = 'abc' where id = 1 . ISTM that the
IV for OLD.text should be thrown away.

Where would the key come from? Where would it be stored? What cipher is used?

--
Andrew Chernow
eSilo, LLC
every bit counts
http://www.esilo.com/