Hi again Les,

Security is depth is certainly the best way I can think of to approach
the issues surrounding any data confidentiality. There are many
factors to consider when approaching such a thing, and most of them
are situation dependant on how you address them. For this you need to
do a proper risk analysis, which I think is probably going beyond the
scope of this forum. If you want to approach such a thing I am happy
to try and steer you in the right direction, so just drop a note in
the forum here.

As for the 4k keys, you must understand that there is a difference in
cryptographic types (algorithms) used. Symmetric and Asymmetric. AES
is a symmetric cipher, commonly used with a 256bit key strength. A
symmetric cipher, in this case AES, is quite fast, safe, and
considered strong for securing information, but it suffers, like all
symmetric encryption, from a problem known as the 'Key Distribution
Problem'. Basically it means that you use the same key to encrypt and
decrypt the data. If you want to send the data to someone with a
symmetric cipher then in order for them to decrypt it they need to
know the same key you do - but you shouldn't transmit the key with the
data! So how do we get around this problem?

The answer lies in Asymmetric encryption. Asymmetric encryption allows
us to have a public and private key which are distinct and separate
from each other, but at the same time directly related to each other.
The way it works is that you can encrypt something with your Private
key (called signing in most instances), and anyone can acquire (safely
and without concern) a copy of your public key and see that the data
came from you. Only your public key can be used to decrypt the data
encrypted with the private key. Now if we reverse the situation, and
we encrypt the data with the public key, only the private key can
decrypt it, which means that anyone can encrypt something, send it to
you, and only you with the private key can decrypt it.

The difference between the two keys is one of information. The private
key contains enough information to be able to reproduce the public key
at will, but the public key is built in such a way that to reproduce
the private key is extremely difficult (but not impossible!). So, what
do we do to make the public key really secure? We use giant 4k keys
that make the problem so large / hard to solve that for all intents
and purposes it is unbreakable / considered secure. The problem with
Asymmetric encryption is that it is slow by comparison to Symmetric.
Slow by a long way.

So how do we solve the problem of your DB encryption? We use
Asymmetric to encrypt the Symmetric keys. The 'heavy lifting' of
encryption / decryption of the data is actually handled by the AES
cipher which is relatively fast, and only the decryption of the AES
keys is done with the slower Asymmetric cipher. This keeps the system
and data both relatively fast and safe, and also gets around the key
distribution problem.

So, crash course in cryptography aside, here are some links that I
have used for the different algorithms and components:

MD5 http://www.di-mgt.com.au/crypto.html#MD5
RSA http://www.di-mgt.com.au/crypto.html#dhvb
AES http://www.frez.co.uk/freecode.htm#rijndael

You will also find some useful code implementations he
http://www.freevbcode.com/ShowCode.asp?ID=3779

I hope that this gets you on your way, and you are successful in
implementing this for your needs. I will monitor this thread if you
need further help with this.

Cheers

The Frog