Ok, so I've encrypted my data now where do I hide the key?

Question

I have a database that contains sensitive information. I can encrypt / decrypt the data on the read write operations. The problem is that I need to store the key in the application. If someone has hacked their way in such they have access to the database then they can also grab the application (java) decomplie it and pull the key.

This seems like a speed bump at best. What other solutions are available?

Answer 1

The only thing you can do is make it difficult to extract the key from your application. You can't make it impossible. If you give someone a box with contents that you're trying to protect, you have to give them the key if you want them to be able to access the contents. Once you give them the key they can do whatever they want… if they take the trouble of finding the key.

This is a case of Bob and Eve being the same person, you want to give Bob access but stop Eve from seeing it.

This is DRM, it doesn't work.