Data encryption within Azure website storing in Azure database

Question

I am wondering what the best way to encrypt/decrypt my documents (which will be stored within my database) while at rest. My web app will allow user to upload document and share them with other people so they can download them.
I want the encryption keys/intial vectors to be generated from code so there is no user input. Here is my current thought which is a hybrid of AES/RSA.
Create a new table called keys within my database which will look like the following...
ID | Key | Vector
then when a document is uploaded the Key/Vector is generated and used to encrypt the document and then the document is saved into the document table returning the document ID, which will be stored within the new table in the ID field along with the key and
vector.
Then i somehow need to protect the keys as anyone who grabs my database will have access to all the doucments still as the keys are there!
So i was thinking i would upload a private certificate into Azure storage and store the public certificate inside my web app so before the key/vector is saved my application will encrypt them with the public certificate.
Then when a user downloads a document, the app will connect to my Azure storage account and grab the private key, it will grab the row from key table associated with the document id they are trying to download and then it will use the private key to decrypt
the key/vector then it will use the key/vector to decrypt the document.
Does this seem the best way forward for how to do it, am i way off, or is there a security hole within this solution?

Answer 1

All your keys are still the same so long as you use one cert to do the work. (and they're all still in one place).  If the app downloads the private key, well - the app and anyone in the middle has the key to figure out the rest and decrypt all the
data.  You'll  struggle to make good security just by adding levels of effort or middle steps like that.
What you're doing is kind of like storing the key to your house in your car, and the car's key is in the car's door lock.  You've just added a single step to get inside your home. 
If I have your DB, I probably have your code, which means I know how to do the rest, and since everything is public, so is the resultant data.
What I'd do is have Azure Storage holding the encrypted data, and a key share table.  Use the DB as an index if you feel you need, but it's cheaper to go with just storage.
Each app would create, have, and hold privately, an AES private key. The app would somehow initially upload the public key for the user to the key share table via your service.
When user A wanted to send to user B, they would get B's public key from the key share.  The App would encrypt A's Document and only then send the encrypted data to B's 'mailbox'. Later, B would come along and see a file was waiting.  They'd download
the encrypted data and then decrypt it with their private key which has never left their app/device/wherever.
Think about making every private key 'private' to the entity owning it.  Don't ever store/share/transmit a private key where any public entity can get it.  That's the only way it'll work.
To make things even harder, you can do things to the data before document encryption, (and after) but never mess with the one golden rule of AES:
Keep "private" private, private!
Darin R.