title: Symmetric encryption keys with HSM
body: <p>I want to use an HSM to encrypt/decrypt sensitive data I will be storing in my database.
  The HSM device / server can create symmetric and asymmetric keys. I want to store data with highest possible security. So I have two approaches:</p>
  
  <p>1) Make HSM generate a public/private key pair and it will keep the private key inside it and it will never leave. Now I can create a random symmetric key per entry I want to encrypt. I encrypt the data with random AES key, encrypt the AES key with public key generated in HSM and store result of encrypted data + encrypted key data in each row in DB.
  Now everytime I want to access the data, I send encrypted key data to HSM, HSM will decrypt it and send me back the decrypted AES key, I use that to actually decrypt data.</p>
  
  <p>2) Per row/per entry, I make HSM to generate AES key and store the symmetric key token in it. I send data in plaintext to it, it sends me back in encrypted form. Everytime I want to access the data, I send encrypted data to HSM and it will decrypt and send it back to me.</p>
  
  <p>HSM server will be a professional and fast one like Thales, so it can handle the traffic with good speed (hopefully).</p>
  
  <p>The thing with first one is I only have to login as SO (Security Officer) to generate and store my public/private key pair in HSM and from now on, I just have to login as Read only user. But its slower and lenghty process compared to number 2.</p>
  
  <p>Number 2 (as far as I know) will require me to have SO access to device whole time.</p>
  
  <p>What do you suggest? Please advise.</p>