Keeping Secrets: Emerging Practice in Database Encryption
summary
Provides concrete advice for protecting high‑sensitivity databases: threat models show volume encryption protects only against disk repurposing, not insiders or backups; deterministic and format‑preserving schemes are practical but vulnerable — researchers reconstruct 60–80% of fields via frequency/histogram attacks; client‑side encryption offers strongest confidentiality but requires heavyweight app changes and indexes; HSMs and envelope keys help but leaks occur through web apps, logs and memory snapshots; emerging mitigations include enclave attestation, strict key segregation and instance‑based temporary credentials.
AI-written summary · about
chapters (13)
- 0:00Database encryption challenges
- 3:11History and myths of encryption
- 7:01Transparent Data Encryption explained
- 10:40Deterministic vs randomized trade-offs
- 15:47Insider threats and DBA limits
- 18:16Oracle histogram attacks
- 22:00Format preserving encryption pitfalls
- 24:56Academic attacks on encrypted DBs
- 26:46Threat model driven design
- 31:54Zero knowledge limits
- 34:48HSM risks and controls
- 37:16Secure Enclave and identity
- 39:45Key management takeaways
related talks
47mData at Rest Encryption Going Beyond the Basics to Address Modern Attacks
51mKeynote: Data is a new security boundary
32mEncryption - A Deeper Review
51mWhere should I be encrypting my data
34mWhy your encrypted Database isn't secure: practical attacks against encrypted OSS databases
30mBehind Closed Doors: Managing Passwords in a Dangerous World- 51mWhere should I be encrypting my data
59mDatabase Encryption in a GDPR World