Skip to main content
Information Security

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

4
  • Thanks Matrix for your response. One more thing, can you suggest where to store the encryption key? What is the best way to secure it? Commented Oct 3, 2013 at 11:40
  • You can derive the encryption key for each token using HMAC(masterKey, somethingUnique), where somethingUnique is something that is unique (and unchangable) to each token row in your database, like tokenId. This way, every token will be encrypted with a unique key. Master key can be stored inside HSM or a software version of it (more flexible). Commented Oct 6, 2013 at 10:02
  • Maybe I'm missing something but why not use a mode of operation that accepts an IV; then you only need to manage the master key and not a unique key for every row. Commented Feb 28, 2014 at 3:50
  • You cannot choose a different mode of operation, ECB is the only option. Commented Feb 28, 2014 at 7:00