The site is to be hosted on a shared internet server, to store non-commercial data and it will be clearly labelled as not for sensitive information.
I wish to offer a credible solution to the risks of any server admin simply being able to read the plain text fields in the database directly or via a backup and similarly should the server be hacked and the database be accessed. There is no perceived threat from determined hackers as the data has little value.
My concerns are mainly connected with key management: storing the encrypted secret key in the database and storing the decrypted secret key in a Session variable. All comments would be welcome.
My plan is as follows:
Use php mcrypt_encrypt(MCRYPT_RIJNDAEL_256). Store the symmetric secret key encrypted on the database using a hash of a secret phrase which would be given to the organsation (upto 10 people).
After a user logs in with their unique username and password they are asked for the secret phrase : if it is entered correctly, the symmetric secret key is decrypted and stored in a session variable, the protected data is decrypted and displayed.
The secret key is stored in a Session variable , which is destroyed when the user logs out or after a session timeout. The site is also protected using apache htaccess as it is not for public use. The php is incorporating methods to defend against xss, injection etc.
Apart from giving the end-user the responsibility to manage the secret phrase does this plan have any obvious weaknesses ?