I'm designing the security of a new application and try to figure out what the best way is to store the keys of the mysql AES encryption in the file system. I've seen several options like store it outside webdirectory in a restricted dir in the filesystem. Also you can store the key in system memory (how do you do this and how do you use it in php/mysql)? So my thoughts were, why not write a custom php extension with a hashing function and also the key store, and restrict the use of this custom functions on the servers ip address. Then this custom extension get compiled and loaded in apache.
Is the above safe? Can a php extension can be decompiled? What if a hacker gets access to the server and runs a php script that makes use of this custom function? (or like the other option: reads the key stored in the filesystem)
Btw: the webserver+db and secure db will be 2 seperated servers.
Hope somebody can help out! Thank you :)