Timeline for Storing encryption key in $_SESSION vs $_COOKIE?
Current License: CC BY-SA 3.0
10 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Sep 11, 2016 at 22:09 | comment | added | symcbean | As usual, Steffen's answer is absolutely correct. However, as is often the case when security professionals start talking, the CI&A takes precedence over what the software is actually intended to do. Both cookie and session provide temporary storage for the key. Unless you want the data access to be exclusive to a specific client device, then you need to think about how an encryption key is created, remains available to the user, populated into the application, optionally recovered....etc. This then has an impact on your design for managing the key over short periods when it is in use. | |
| Sep 11, 2016 at 15:31 | answer | added | Steffen Ullrich | timeline score: 1 | |
| Sep 11, 2016 at 14:57 | comment | added | IMB | @SteffenUllrich AFAIK it is possible to set the session handler of $_SESSION to memcache which is a memory based storage. Besides you also can modify the behavior of $_SESSION to clean-up periodically whether or not it is memory-based. Anyway regardless... what is the general consensus in $_SESSION vs $_COOKIES as far as crypto key storage is concerned? | |
| Sep 11, 2016 at 14:53 | comment | added | Steffen Ullrich |
The advise does not mention $_SESSION but talks about some session storage with the important features of temporary and memory-backed. As far as I know there are different implementations possible for the session object, including cookies or database. While the last one is stored on the server like you assume it is definitely not memory-backed and maybe not even temporary. It is definitely not a good idea to keep the key together with the encrypted data on disk.
|
|
| Sep 11, 2016 at 14:34 | history | edited | IMB | CC BY-SA 3.0 |
added 414 characters in body
|
| Sep 11, 2016 at 14:33 | comment | added | IMB | @SteffenUllrich As mentioned, it follows Scenario #2 in the tutorial. I updated the question for you. | |
| Sep 11, 2016 at 4:50 | review | Close votes | |||
| Sep 12, 2016 at 8:35 | |||||
| Sep 11, 2016 at 4:31 | comment | added | Steffen Ullrich | I think this question needs more information, especially where the encrypted data are located in comparison to the key. They should not be at the same place, i.e. both on the local machine or both on the network. Apart from that I cannot see any recommendation regarding storing the key in the session variable in the tutorial you reference so where does this advice comes from and how is it justified? Please add this information to the question and not in a comment. | |
| Sep 10, 2016 at 20:36 | history | edited | IMB | CC BY-SA 3.0 |
edited body
|
| Sep 10, 2016 at 20:29 | history | asked | IMB | CC BY-SA 3.0 |