I'm looking for an efficient way to encrypt multiple fields in a database with AES using a single global key, used throughout a large web application.

Obviously in order to re-use this key, a unique random IV is required for each field that is to be encrypted.

I'd rather not introduce more fields to the database to store each of these IVs, so the programatic approach seems to be to derive these IVs some how.

I'm toying with using either:

key = sha256(global_key + table_name)
iv = sha256(column_name + primary_key)


Or even simply:

key = global_key
iv = sha256(table_name + column_name + primary_key)


I'm leaning towards the former to generate per-table keys.

I've already read that the IVs do not need to be kept secret. So I'm working on the assumption that a derived key or IV (even if the algorithm becomes known), is no more insecure than any other non-secret IV, as long as the original key remains secret.

The question is:

Is there a fatal flaw in my approach? Am I introducing any serious weaknesses that, in the event that an adversary obtains a copy of the database, would make it easier for them to retrieve the plaintext data?

I realise that is potentially soliciting one word answers.

Suggestions for alternate / better schemes very much welcomed, as well as references to existing works and how they implement similar scenarios.


Question: Why do features in QGIS drawn on same datum as Google imagery from OpenLayers move?
Answer: Indeed, when you'll try to capture a vector data (no mater it's a point, a line or a polygon), using the Google Satelite map as the background layer, you will notice unpleasant displacements at different zoom levels:



But the beauty of the OpenLayers plugin is due to the fact it loads a lot of other useful maps to do your job. I recommend you to use the Bing Road map (the line keeps its position when changing the zoom level):