meta user
network profile
| bio | website | |
|---|---|---|
| location | ||
| age | ||
| visits | member for | 9 months |
| seen | Mar 31 at 23:25 | |
| stats | profile views | 14 |
|
2d |
awarded | Popular Question |
|
Jan 21 |
comment |
Maintain sensitive key between requests What do you mean for "session is invalidated"? Log out? expired time? |
|
Jan 21 |
comment |
Maintain sensitive key between requests No, the first pages are public so only http. When the user wants to login, I redirect him over https to a login form and the logged session is entirely over ssl. Can the session be considered secure? |
|
Jan 21 |
comment |
Maintain sensitive key between requests Just a thing: Will I use the same algo (aes) or it's better if every level has a different algo(aes,blowfish, etc)? |
|
Jan 21 |
comment |
Maintain sensitive key between requests Exactly what I was thinking about. The cipher of the session key is stored in PHP standard session.. I'll adopt the alternate approach with multiple encryption with different factors (sessionkey_1 in cookie, sessionkey_2 in apc_cache, useragent) as keys.. thanks a lot! |
|
Jan 21 |
comment |
Maintain sensitive key between requests No, the key must be available only when the user is logged. I don't want to permanently store it server side, because it's riskful and fully unuseful in my scheme. Thanks a lot for your time! |
|
Jan 21 |
comment |
Maintain sensitive key between requests So, I should save the encryption key, under which I encrypted uk, in the DB with the tree pieces. Later, if there is a record with the three pieces, then I should return the key field, so that the script can recover the uk and go on with the decr/encryption process. Am I right? |
|
Jan 21 |
comment |
Maintain sensitive key between requests It seems that GCM and CCM modes aren't available php.net/manual/en/function.openssl-get-cipher-methods.php .. what do you advise me? Thanks for your very helpful support! |
|
Jan 21 |
comment |
Maintain sensitive key between requests Sorry for the poor question and thanks for your exhaustive answer ! What exactly do you mean by "generate multiple tokens that can be stored by different means"? It's just what I thought about... could you give me some links or some hints about this multiple-token generation process? |
|
Jan 21 |
revised |
Maintain sensitive key between requests added 3 characters in body |
|
Jan 21 |
comment |
Maintain sensitive key between requests I'm sorry, I've reworked my own question. Is it better? Thanks again |
|
Jan 21 |
comment |
Maintain sensitive key between requests I'm sorry, I've reworked my own question. Is it better? Thanks again |
|
Jan 21 |
revised |
Maintain sensitive key between requests reworked question |
|
Jan 21 |
comment |
Maintain sensitive key between requests 1) I haven't understood "It is fine for the IV to be known, it just prevents attacks"... did you mean **un**known? 2) I want to make the IV secret just because I'm worry that the key could be stolen. |
|
Jan 21 |
comment |
Maintain sensitive key between requests I haven't understood: all the user area is protected with SSL. Isn't this enough? Added details in the question! Thanks again! |
|
Jan 21 |
revised |
Maintain sensitive key between requests added 3 characters in body |
|
Jan 21 |
comment |
Maintain sensitive key between requests Oops, I've made a terrible typo.. I meant "Store the IV in a cookie" instead of "in a key"! Anyway all the encr/decryption process happens serverside and the result is sent over ssl to the client. Should I decrypt client-side? |
|
Jan 21 |
revised |
Maintain sensitive key between requests added 3 characters in body |
|
Jan 21 |
asked | Maintain sensitive key between requests |
|
Jan 17 |
comment |
Implementation review - Independent key, admin side and user side @AJHenderson Thanks a lot for suggestions... updated question! |
