Re: best practices for encryption key managment??

Larry,
And now you have discovered the crux of the problem with encryption.

Encypting data is relatively easy, managing it doesn't seem to be.

There was an article in recent issue of SELECT ( www.selectonline.org ) 
where the 
author stored the key with the card number.  Each card number had it's own 
key. 

The purpose was to minimize the impact of someone getting hold of a key.

HTH

Jared



oracle-l-bounce@xxxxxxxxxxxxx wrote on 05/26/2004 10:07:14 AM:

> We are using the dbms_obfuscation toolkit to encrypt sensitive data per
> VISA's requirements. 
> Has anyone gone through the VISA audit before?  They are not clear on 
their
> expectations for encryption...
> 
> I've found next to no info on key management - our plan is store the key 
in
> the database and also in pvcs with access limited to the dba team.
> 
> Any advice or experience to share would be appreciated...
> 
> Thanks,
> 
> Larry
> Larry Lane
> Senior Database Administrator
> EchoStar Satellite L.L.C
> 9601 South Meridian Blvd
> Englewood, CO 80112
> 
> email:     lawrence.lane@xxxxxxxxxxxx
> 


----------------------------------------------------------------
Please see the official ORACLE-L FAQ: http://www.orafaq.com
----------------------------------------------------------------
To unsubscribe send email to:  oracle-l-request@xxxxxxxxxxxxx
put 'unsubscribe' in the subject line.
--
Archives are at http://www.freelists.org/archives/oracle-l/
FAQ is at http://www.freelists.org/help/fom-serve/cache/1.html
-----------------------------------------------------------------

Other related posts: