There are a few cryptography tasks that are common to many
backends. For example, you should store passwords such that a
database leak doesn't expose them, you should sign payloads so
the receiving side can verify them, you should keep a column's
data unreadable outside the database, and you should mint tokens
an attacker cannot guess. MySQL's built-in functions cover part
of that ground but fall short for many users. The
SHA2() function will hash a password, but nothing
salts it for you, so two people who pick the same password end up
with the same stored value. MySQL does not have a built-in HMAC
function. An HMAC is the keyed hash a receiver uses to tell a
real message from a forged one.
When a database doesn't solve a problem natively, the work invariably moves up into application code, where every service reimplements it just a little bit differently. This adds ongoing maintenance complexity.
The …
[Read more]