Timeline for Is it secure to save a salt in session variables
Current License: CC BY-SA 4.0
18 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jun 13 at 4:30 | history | edited | Èl Sea | CC BY-SA 4.0 |
Clarified body to better match question
|
| Jun 13 at 4:23 | vote | accept | Èl Sea | ||
| Jun 13 at 2:12 | answer | added | CaffeineAddiction | timeline score: 3 | |
| Jun 13 at 2:02 | history | edited | Èl Sea | CC BY-SA 4.0 |
added 3128 characters in body
|
| Jun 12 at 23:24 | comment | added | Èl Sea | @mti2935 my login is separate and I believe salting is already handled by natively by password_hash() function? The key for the passwords in the database is derived from dedicated password. I have updated the encryption/decryption so each password a user has in the database has its own salt. I will update the question when I get a chance, but that will be in about 12 hours. Question is most likely moot now as the salt will be retrieve with the password lookup as previously mentioned above. | |
| Jun 12 at 15:29 | comment | added | mti2935 | OP, Are you using the password to authenticate the client with the server? Or, are you using the password to derive a key, which is then used to encrypt other passwords? Or, both? Also, is the encryption of the other passwords done on the client side, or the server side? | |
| Jun 12 at 13:17 | comment | added | Èl Sea | @mti2935 i am a rooky but think you are correct. I am using php sodium_crypto_secretbox() | |
| Jun 12 at 13:15 | comment | added | Èl Sea | @Najkin so no point storing it really. It is mainly going to be used when a password in the password manager is updated, the password to login is changed, or the master database password is changed, which will trigger a change to the salt, encryption key and re-encryption of all the passwords. I feel i may be overcomplicating it. I might just add the database call | |
| Jun 12 at 13:11 | comment | added | Èl Sea | @schroeder also the salt would be reloaded from the session variable when the password for the password manager is changed so it can re-encrypt the passwords in database and change the key and salt. I am completely new to this, and untrained, so let me know where my mistakes lie. | |
| Jun 12 at 13:09 | comment | added | Èl Sea | @schroeder the salt is used as part of the password manager, but after your comment i went back and had a look and realised that after the user is logged in the salt was loaded into a session variable. It appears I dont currently do anything with it. I have done a lot wrong with encryption and am in the process of changing it all over to the sodium library. login is php's password_hash($pass,PASSWORD_DEFAULT) followed by challenge response 2fa. the password manager is sodiums secretbox and keygen using a separate salted password. it is this salt i want to store in the session. any issues? | |
| Jun 12 at 12:58 | comment | added | Èl Sea | @security_paranoid, for fun mainly, and in case my wife wants to use some of the features. | |
| Jun 12 at 12:01 | comment | added | mti2935 | OP, it sounds like you are using a KDF to derive a key from a password + salt, then using the key to encrypt some plaintext using symmetric encryption. If that's the case, then you can simply store the salt with the ciphertext. This is how openssl does it. | |
| Jun 12 at 10:45 | comment | added | Najkin | @ThoriumBR and even then, in this case, the salt would be retrieved together with the password hash and there would be no reason to keep it in session | |
| Jun 12 at 10:03 | comment | added | ThoriumBR | You would need the salt only if you are authenticating multiple times per session, so perhaps you are using the password multiple times per session. That should not be happening. | |
| Jun 12 at 9:50 | comment | added | schroeder♦ | The better question is "why is the salt required so many times in a single session?" I'm thinking your session management structure is broken. | |
| Jun 12 at 9:49 | history | edited | schroeder♦ | CC BY-SA 4.0 |
deleted 10 characters in body
|
| Jun 12 at 9:46 | comment | added | security_paranoid | If you don't mind me asking, why is it written for multiple users if it will only be yourself? Or are you planning for the future? | |
| Jun 12 at 8:46 | history | asked | Èl Sea | CC BY-SA 4.0 |