192 reputation
211
bio website
location
age
visits member for 2 years, 3 months
seen Jul 2 at 22:30

Jul
25
awarded  Popular Question
Jul
2
awarded  Curious
Apr
5
awarded  Notable Question
Feb
27
awarded  Popular Question
Jan
27
awarded  Notable Question
Jun
16
awarded  Popular Question
May
21
awarded  Popular Question
Jan
21
comment Maintain sensitive key between requests
What do you mean for "session is invalidated"? Log out? expired time?
Jan
21
comment Maintain sensitive key between requests
No, the first pages are public so only http. When the user wants to login, I redirect him over https to a login form and the logged session is entirely over ssl. Can the session be considered secure?
Jan
21
comment Maintain sensitive key between requests
Just a thing: Will I use the same algo (aes) or it's better if every level has a different algo(aes,blowfish, etc)?
Jan
21
comment Maintain sensitive key between requests
Exactly what I was thinking about. The cipher of the session key is stored in PHP standard session.. I'll adopt the alternate approach with multiple encryption with different factors (sessionkey_1 in cookie, sessionkey_2 in apc_cache, useragent) as keys.. thanks a lot!
Jan
21
comment Maintain sensitive key between requests
No, the key must be available only when the user is logged. I don't want to permanently store it server side, because it's riskful and fully unuseful in my scheme. Thanks a lot for your time!
Jan
21
comment Maintain sensitive key between requests
So, I should save the encryption key, under which I encrypted uk, in the DB with the tree pieces. Later, if there is a record with the three pieces, then I should return the key field, so that the script can recover the uk and go on with the decr/encryption process. Am I right?
Jan
21
comment Maintain sensitive key between requests
It seems that GCM and CCM modes aren't available php.net/manual/en/function.openssl-get-cipher-methods.php .. what do you advise me? Thanks for your very helpful support!
Jan
21
comment Maintain sensitive key between requests
Sorry for the poor question and thanks for your exhaustive answer ! What exactly do you mean by "generate multiple tokens that can be stored by different means"? It's just what I thought about... could you give me some links or some hints about this multiple-token generation process?
Jan
21
revised Maintain sensitive key between requests
added 3 characters in body
Jan
21
comment Maintain sensitive key between requests
I'm sorry, I've reworked my own question. Is it better? Thanks again
Jan
21
comment Maintain sensitive key between requests
I'm sorry, I've reworked my own question. Is it better? Thanks again
Jan
21
revised Maintain sensitive key between requests
reworked question
Jan
21
comment Maintain sensitive key between requests
1) I haven't understood "It is fine for the IV to be known, it just prevents attacks"... did you mean unknown? 2) I want to make the IV secret just because I'm worry that the key could be stolen.