title: Secure encrypted database design
body: <p>I have a web based (perl/MySQL) CRM system, and I need a section for HR to add details about disciplinary actions and salary.</p>
  
  <p>All this information that we store in the database needs to be encrypted so that we developers can't see it.</p>
  
  <p>I was thinking about using AES encryption, but what do I use as the key? If I use the HR Manager's password then if she forgets her password, we lose all HR information. If she changes her password, then we have to decrypt all information and re-encrypt with the new password, which seems inefficient, and dangerous, and could go horrifically wrong if there's an error half way through the process.</p>
  
  <p>I had the idea that I could have an encryption key that encrypts all the information, and use the HR manager's password to encrypt the key. Then she can change her password all she likes and we'll only need to re-encrypt the key. (And without the HR Manager's password, the data is secure)</p>
  
  <p>But then there's still the problem of multi-user access to the encrypted data.</p>
  
  <p>I could keep a 'plaintext' copy of the key off site, and encrypt it with each new HR person's password. But then I know the master key, which doesn't seem ideal.</p>
  
  <p>Has anyone tried this before, and succeeded?</p>