What is proper way to crypt some fields?

[Andrzej 0]

I am planning to crypt not whole database but some columns. I have Firebird database and FireDAC components.

1. How make available to show table decrypted with FireDAC? I must use procedure with 'select' statement?

2. Probably I must make salt.

User password will be converted time consument way to 128,192, or 256 bit key. For example million od sha, but better Argon2 with memory consumed.

But I have records. I don't want crypt each record as beginning crypted message - two identical records should give different crypted message.

Is needed salt? How do it?

[Remy Lebeau 1258]

Most databases I've seen do not support per-column encryption.  So you are likely going to have to manually encrypt your data before inserting it into the database, and manually decrypt the data when pulling it back out.  That has nothing to do with FireDAC or the underlying DBMS itself, all you will need from them is a column type that can hold arbitrary data, such as a binary blob field.

 

And yes, you should use salts.  Do not store the actual passwords in the encrypted data or in the database.  Hash the passwords with a salt and store the hash instead.  Recompute the hash whenever you need to compare passwords.

[Andrzej 0]

If this will be with blobs, how make visible data in table? I thought about SQL AES procedure to select.

But is another problem - indices. I can't goto to decrypted value and sort by encrypted column.

Select can use SQL procedure, but this procedure can be below hashing indices?

For example

Person1 - secret1

Person2 - secret2

Important: It must be possible dsplay secret for person.

not so important: sort table by secret

not so important: go to secret, or een part of secret

Here secret is not password, rather is passport , car cart or other personal identifier.

 

Edited April 29, 2022 by Andrzej

[Ruslan 5]

There is a way to encrypt the Firebird database, the is a sample in Firebird documentation.

Unlucky me I wasn't able to create a encryption/decryption module for Firebird, most because of no time, maybe you could try to create one and share the results and will have a lot of thanks and appreciations for that.

Most encryption/decryption modules prices are tooo big.

[Pieter Bas Hofstede 14]

Firebird 4.0 is enhanced with encryption algorithms see firebird-40-language-reference

Its up to you to

- encrypt/decrypt some fields only at Firebird-side

- encrypt/decrypt some fields at your business/data-logic side (so database will have some binary encrypted content)

- encrypt the complete database (you will need external plugins for that)

Edited April 29, 2022 by Pieter Bas Hofstede