Edit: Rephrased title to hopefully get some interest on what I would have thought was a common issue ?
I am developing a website using php/mySQL to store non-commercial data and it will be clearly labelled as not for sensitive information. The site is to be hosted on a shared internet server.
As i am using a shared server I have already accepted that this website will be very limited in terms of absolute data security but I wish to at least offer the option of a credible solution to the risks of any server admin simply being able to read the plain text fields in the database directly or via a backup and similarly should the server be hacked and the database be accessed. There is no perceived threat from determined hackers as the data would have little value.
My concerns are mainly connected with key management: storing the encrypted secret key in the database and storing the decrypted secret key in a Session variable. All comments would be welcome.
My proposal is as follows:
- use symmetric encrypt/decrypt with php mcrypt_encrypt(MCRYPT_RIJNDAEL_256)
- Store the symmetric secret key encrypted on the database using a hash of a secret phrase
- the secret phrase would be given to the organsation where there might be upto 10 people who need to use it
- After a user logs in with their unique username and password they are asked for the secret phrase : if it is entered correctly the text data is decrypted and displayed. If they do not enter the correct phrase it is not sent to the web browser.
- the secret key is stored in a Session variable , which is destroyed when the user logs out or after a session timeout.
- the site is also protected using apache htaccess as it is not for public use
- the php is incorporating methods to defend against xss, injection etc