I'm writing a web and Android app that allows users to store and access some potentially private data. The transmission of this data over RPC is already protected with SSL. I'm currently storing this piece of data in a Text
property, without any encryption. I'm now looking at ways to better protect the storage of the data.
Question 1: Are there any general best practices or tips for encrypting data for storage on App Engine?
One idea I had was to switch the property to a Blob
field, transmit only encrypted data over the wire, and do decryption and encryption in the clients (in Javascript and on Android).
For the encryption key, I'm looking at just using the logged-in user's email address provided by the UserService
. The user email address is known only when the user is logged in, and the sensitive entity has no reference to the user's email address — only the user ID.
Question 2: Does the user email address make sense as an encryption key? If not, what are other well-known options for encryption keys?