Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm building a database that symmetrically encrypts user data. Nothing super sensitive, I'd use a third-party if it was. The data is encrypted with a surrogate key; the user must enter a password to decrypt the data. An evil DBA cannot view the data as it's encrypted. Pretty standard so far.

Given that only the user password (or rather, its hash) can decrypt database records, I need to somehow pass it across the session. So:

  • I create my own unique session ID and store it in the database, in table "session". The same value is stored as a cookie in the user's machine ("user_session").
  • The database also contains a random key associated with that session ID. Another cookie, "user_pass", holds a XOR result of a hash of this random key and a hash of the user's password.
  • When the user queries the encrypted database, the program XORs the "user_pass" cookie with the random key in the database -> arrives at the hash of the user password -> decrypts the db records. This way, no complete password data is stored on the server (in a temp session directory or in the database), nor in the user's machine.

Is this the standard way of storing a key across the session? remember it's used to decrypt the database records. Assume we're using SSL.

Vulnerabilities with DB backed session tokens and Is it safe to store password in PHP session? discuss this but don't fully answer my question.

share|improve this question

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.