Re-encrypting data on a hash chain
Techniques are disclosed for managing encrypted data stored in one or more blocks of a first data structure. One embodiment presented herein includes a computer-implemented method, which includes retrieving the encrypted data from the one or more blocks. The method further includes placing the encrypted data in a container object. The method further includes applying an encryption technique to the container object to generate an encrypted container object and a key. The method further includes generating a second data structure. A first block of the second data structure may include either the encrypted container object or information related to the encrypted container object.
1. A computer-implemented method for managing encrypted data, comprising:
retrieving, by a data retriever, encrypted data from one or more blocks of a first data structure;
applying, by an encryption engine, an encryption technique to the encrypted data to generate further encrypted data, wherein the encryption technique is different than an encryption technique used to generate the encrypted data;
generating a second data structure, wherein the first data structure and the second data structure comprise hash chains, and wherein a first block of the second data structure comprises either:
the further encrypted data; or
information related to the further encrypted data.
2. The computer-implemented method of claim 1 , wherein the encrypted data was encrypted with an outdated or compromised cryptographic hash function.
3. The computer-implemented method of claim 1 , wherein the first block of the second data structure comprises information related to the further encrypted data, and wherein the method further comprises storing the further encrypted data separately from both the first data structure and the second data structure.
4. The computer-implemented method of claim 3 , wherein the information related to the further encrypted data comprises a hash and a storage location of the further encrypted data.
5. The computer-implemented method of claim 1 , further comprising: either erasing or prohibiting access to the first data structure.
6. The computer-implemented method of claim 1 , wherein the hash chains are blockchains.
7. A system, comprising:
a processor; and
a memory comprising instructions that, when executed by the processor, cause the system to perform a method for managing encrypted data, the method comprising:
retrieving, by a data retriever, encrypted data from one or more blocks of a first data structure;
applying, by an encryption engine, an encryption technique to the encrypted data to generate further encrypted data, wherein the encryption technique is different than an encryption technique used to generate the encrypted data;
generating a second data structure, wherein the first data structure and the second data structure comprise hash chains, and wherein a first block of the second data structure comprises either:
the further encrypted data; or
information related to the further encrypted data.
8. The system of claim 7 , wherein the encrypted data was encrypted with an outdated or compromised cryptographic hash function.
9. The system of claim 7 , wherein the first block of the second data structure comprises information related to the further encrypted data, and wherein the method further comprises storing the further encrypted data separately from both the first data structure and the second data structure.
10. The system of claim 9 , wherein the information related to the further encrypted data comprises a hash and a storage location of the further encrypted data.
11. The system of claim 7 , wherein the method further comprises either erasing or prohibiting access to the first data structure.
12. The system of claim 7 , wherein the hash chains are blockchains.
13. A computer-implemented method for managing encrypted data, comprising:
retrieving, by a data retriever, encrypted data from one or more blocks of a first data structure;
applying, by an encryption engine, an encryption technique to the encrypted data to generate further encrypted data, wherein the encryption technique is different than an encryption technique used to generate the encrypted data;
generating a second data structure, wherein the first data structure and the second data structure comprise hash chains, and wherein a first block of the second data structure comprises either:
the further encrypted data; or
an encryption key for the further encrypted data.
14. The computer-implemented method of claim 13 , wherein the encrypted was encrypted with an outdated or compromised cryptographic hash function.
15. The computer-implemented method of claim 13 , wherein the first block of the second data structure comprises the encryption key for the further encrypted data, and wherein the method further comprises storing the further encrypted data separately from both the first data structure and the second data structure.
16. The computer-implemented method of claim 15 , wherein the first block of the second data structure comprises the encryption key for the further encrypted data, and wherein the first block of the second data structure further comprises a storage location of the further encrypted data.
17. The computer-implemented method of claim 15 , further comprising: either erasing or prohibiting access to the first data structure.
18. The computer-implemented method of claim 13 , wherein the hash chains are blockchains.