Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Edit: Rephrased title to hopefully get some interest on what I would have thought was a common issue ?

I am developing a website using php/mySQL to store non-commercial data and it will be clearly labelled as not for sensitive information. The site is to be hosted on a shared internet server.

As i am using a shared server I have already accepted that this website will be very limited in terms of absolute data security but I wish to at least offer the option of a credible solution to the risks of any server admin simply being able to read the plain text fields in the database directly or via a backup and similarly should the server be hacked and the database be accessed. There is no perceived threat from determined hackers as the data would have little value.

My concerns are mainly connected with key management: storing the encrypted secret key in the database and storing the decrypted secret key in a Session variable. All comments would be welcome.

My proposal is as follows:

  • use symmetric encrypt/decrypt with php mcrypt_encrypt(MCRYPT_RIJNDAEL_256)
  • Store the symmetric secret key encrypted on the database using a hash of a secret phrase
  • the secret phrase would be given to the organsation where there might be upto 10 people who need to use it
  • After a user logs in with their unique username and password they are asked for the secret phrase : if it is entered correctly the text data is decrypted and displayed. If they do not enter the correct phrase it is not sent to the web browser.
  • the secret key is stored in a Session variable , which is destroyed when the user logs out or after a session timeout.
  • the site is also protected using apache htaccess as it is not for public use
  • the php is incorporating methods to defend against xss, injection etc
share|improve this question
    
I can't comment on the actual question, but one point deserves attention. You said: "There is no perceived threat from determined hackers as the data would have little value". This is not always true. If your server is located at a strategic position, compromising your server might be the easiest way to get to the intended one. Obviously you might know your environment and should be in position to ascertain whether this is the case or not. –  Lex Nov 15 '13 at 11:23
    
Have you looked at things like secret splitting and key derivation functions? –  atk Jun 6 at 23:48

1 Answer 1

I was thinking about doing a similar thing. I came across this answer while searching which seems to imply that this is an acceptable practice as long as you aren't using passwords or password hashes in the key. http://security.stackexchange.com/a/18998/39545

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.