aes - how to store an encryption secret key safely -

i asked @ work protect sensitive data kept mysql database. database contains several tables, among 1 has critical data should accessed using api done in django. api there number of people have access it, persons able access data table.

so, problem moment has access database , table, decided encrypt data table using aes, aid of aes_encrypt() , aes_decrypt() functions (according https://dev.mysql.com/doc/refman/5.5/en/encryption-functions.html).

so.... point ok, main problem how store aes key used encryption/decryption. after brainstorming colleagues , google, found best thing use key wrapper (http://en.wikipedia.org/wiki/key_wrap), consists in encrypting original key (the master key) using keys belong persons can access api interacts database table. so, thinking encrypting key using public key of each person's public key has access api, , store encrypted version table can access. , then, when user needs master key, he/she needs retrieve encrypted key, decrypt his/her private key, , he/she have key login session able use via api.

i want know if there better alternatives this.

the approach of using 1 key encrypt content ("content encryption key," or cek), encrypting that key key of each authorized recipient ("key encryption key," or kek) one, , it's used in number of standard protocols s/mime, pgp, etc.

but: in environment, store private keys authorized users? how keep them private?

feasibility depends on application, might better use symmetric algorithm encrypt cek each user. whenever user wants access cek, have re-enter password server never stores key in clear.