322 reputation
413
bio website
location
age
visits member for 2 years, 11 months
seen Jul 22 at 8:48

Jul
22
awarded  Caucus
Jul
16
awarded  Popular Question
Jul
16
comment Clarification about IV in PBKDF2 to generate encryption key
Thanks a lot for the detailed answer, as usual of you.. could you please tell me something about the code posted? I don't provide openssl_encrypt a salt (and I don't disable it) so I think that openssl thinks to it (i.e. generates and store in the header a random salt). Is that wrong?
Jul
15
reviewed Approve Clarification about IV in PBKDF2 to generate encryption key
Jul
15
asked Clarification about IV in PBKDF2 to generate encryption key
Feb
16
awarded  Notable Question
Feb
2
awarded  Yearling
Jul
25
awarded  Popular Question
Jul
2
awarded  Curious
Apr
5
awarded  Notable Question
Feb
27
awarded  Popular Question
Jan
27
awarded  Notable Question
Jun
16
awarded  Popular Question
May
21
awarded  Popular Question
Jan
21
comment Maintain sensitive key between requests
What do you mean for "session is invalidated"? Log out? expired time?
Jan
21
comment Maintain sensitive key between requests
No, the first pages are public so only http. When the user wants to login, I redirect him over https to a login form and the logged session is entirely over ssl. Can the session be considered secure?
Jan
21
comment Maintain sensitive key between requests
Just a thing: Will I use the same algo (aes) or it's better if every level has a different algo(aes,blowfish, etc)?
Jan
21
comment Maintain sensitive key between requests
Exactly what I was thinking about. The cipher of the session key is stored in PHP standard session.. I'll adopt the alternate approach with multiple encryption with different factors (sessionkey_1 in cookie, sessionkey_2 in apc_cache, useragent) as keys.. thanks a lot!
Jan
21
comment Maintain sensitive key between requests
No, the key must be available only when the user is logged. I don't want to permanently store it server side, because it's riskful and fully unuseful in my scheme. Thanks a lot for your time!
Jan
21
comment Maintain sensitive key between requests
So, I should save the encryption key, under which I encrypted uk, in the DB with the tree pieces. Later, if there is a record with the three pieces, then I should return the key field, so that the script can recover the uk and go on with the decr/encryption process. Am I right?