Re: Field Level Encryption - Best Practices

[<franz400@xxxxxxxxxxxx>]

Do not store the key in same record as encrypted data!
Much of the complexity is in generating and storing keys.
If this project is to meet a particular standard (PCI, HIPAA, etc) then even though some standards are expressed in broad terms, make sure your design meets or exceeds those standards. Would suggest you also look at proposals to update the standards so that you can meet those now and not have to retrofit later. 
PCI standard is pretty clear that encryption alone does not meet the standard.
Jim Franz
---- Michael Ryan <michaelrtr@xxxxxxxxx> wrote: 
> Looking for input. Embarking on a project to encrypt certain fields in
> different files. My first thought is to have a shadow file containing
> the encrypted fields, and then having a process to do
> encryption/decryption as needed. I would blank/zero the fields in the
> 'master' file. I was thinking a shadow file because 1. - I wouldn't
> have to change the format of the 'master' file; anmd 2. - I wouldn't
> care about the difference in field length (encrypted/unencrypted).
> Ideas? Thoughts? Thanks!
> -- 
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.