Re: using mySQL to store credit card info

[Thomas Butler]

"2. Encryption_password can be stored encrypted by user password for any user who need it. When user logon, Encryption_password is decrypted by user-logon-password and stored into the RAM. Encryption_password when stored into the memory can be additionally encrypted by session_password for current session"

This is a good approach when you want to have each user to have access to their sensitive data using their own encryption key.

In our case, we need to have a single encryption key that is used within the front-end Java application to encrypt Social Security #'s (SSN) being stored in the database. At a later date, we need to be able to decrypt all of the SSN's for tax purposes.

I have searched the forum and not yet found a good answer for how to protect the encryption key in the front-end Java application. For example, our Java front-end web app will contain the query to encrypt the data the user has inputted in the web form. How can we protect the encryption key in the Java code?