Database Encryption in a GDPR World
summary
Shows concrete steps: use PHP's lib sodium (crypto_secretbox) not OpenSSL, avoid MySQL AES ECB pitfalls, and mimic Dropbox by sha512 then bcrypt then AES for passwords. Keeps search fast by storing per-row salts and bloom filters to hit indexes, with a real migration path that rotates reads then drops plaintext columns and handles zero-downtime backfill. Key management uses Vault/AWS KMS or HSM, key rotation is required, and measured overhead is small (around three percent) while a full table encrypt can take hours.
AI-written summary · about
chapters (16)
- 0:00Start
- 15:35Encryption at rest
- 16:40Application level encryption
- 18:36The easy way
- 27:18Functions for bloom filters?
- 28:06Encrypted Example
- 29:33Easiest Solution
- 30:00No Downtime solution
- 31:40Remember to use an Interface!
- 33:02Chance for a refactor
- 38:23SOL Standard for whitespace
- 39:08Performance Tweaks
- 40:37Unique Keys
- 41:08Fuzzy matching
- 43:04Key Rotation
- 45:50Timing Attacks
related talks
29mData encryption made easy
29mProtecting data vs systems: practicality, performance, and problems...
47mData at Rest Encryption Going Beyond the Basics to Address Modern Attacks
41mKeeping Secrets: Emerging Practice in Database Encryption
48mColumn encryption solutions and ideas
46mCryptography For Beginners
19mTop Security Questions: Delight Your CISO and Protect Your Business
51mWhere should I be encrypting my data