Does it make sense to store the encryption key in the database?

Question

Node.js

It is necessary to store data in the database in encrypted form (not passwords). I encrypt with node-rsa. So that in case of hacking the database, the data was not in a dry form. To decrypt the data in another controller, you need the same key that would be generated at the time of encryption. The only option is to save it to the database. Do I understand correctly that if the database is hacked, the attacker will take this key and easily decrypt the data? Maybe there is another approach to this issue?

Answer 1

it makes no sense to store it in the database - when you leave home, you hardly hang the key next to the lock.
You can store it in the config, environment variables, separate storage.

Answer 2

It is better to store the key in the environment variables of the user under which the web server is running.

Answer 3

> Do I understand correctly that in the event of a hacking of the database, the attacker will take this
> key and easily decrypt the data?
Yes .
This is quite justified - but you need to change the encryption protocol, for example, enter also the SALT for the key (Key = KeyDB + SALT).
In this case, your KeyDB will be stored in the database, but in order to use it, you will also need a Salt that is stored in the Config. The keys can even be different (for each table) but the SALT is the same.
If the base is lost, no one will be able to restore the Key. If you lose the Config - there is only SALT.
This increases the Attack Difficulty by an order of magnitude.
Of course, you still won't be able to protect yourself from Insider Admins. But at least you, as an Architect, will not show negligence :)