I am developing a software that handles privacy sensitive data in a local network environment, using Mac computers, to which only a select group of people may have access.

I need to understand how I can provide secure and personalized access to the (same) data by each authorized person.

The data is stored in a SQL database (currently Sqlite but eventually probably Postgresql) and shall be encrypted in the database file. The DB engine shall be able to decrypt the data so that it can search it effortlessly, i.e. I do not want to encrypt the data on the client end already.

With that, I believe that when opening the database, a decryption key needs to be provided since the database cannot manage that on its own. Which means that the computers accessing the server have to know the key. From what I've learned so far, this is done like this:

Each authorized user has a password - that password is used to create a hash code. The hash code is then used to encrypt and decrypt the secret data, in this case the key for the database. This means that for each user account I create, I have to encrypt the same DB key with the user's password.

Furthermore, to prevent people from giving away their passwords too easily, a physical key shall be used to authenticate each user. Some keycard system, probably.

I do not know any keycard systems nor have I ever looked into any authentication systems (e.g, I suspect Kerberos is something related to that, but I have never used it, so there's my level of "expertise" in this area).

My questions are:

  • How does authentication work with a keycard? What is the output I get from the card reader so that I can then authenticate a user with it? I do need to end up with a hash code to decrypt that user's encrypted data in the end, after all.

  • What kind of keycards are there for Macs that I can use for custom user authentication in my scenario? I guess I need something that comes with a set of programmable cards? At worst, I imagine I can use any USB based card system as long as its USB level API is publically documented (I've managed to write USB drivers for the Mac in the past). But I don't even know what to look for. What are the systems called I should look for? I've ran into RSA for instance, but I can't even tell if that's suitable for my purpose from their marketing-focused website.

  • I just learned about RFID tags - they're practically cards with a fixed UUID on them. That's not going to work as they can be easily scanned and replicated, I think. So I rather need something that's actually running a little CPU inside, to perform some secret challenge-response process. As someone pointed out, that'd be "smart cards", I assume now.

Update 1

I had some additional thoughts on using RFID cards. While they can be copied easily, I could combine them with having the user enter a personal password, then use the RFID's unique ID with the password to create a hash code that I then use to decode the encryption key for the database. An attacker would therefore need two things - the card and the user's password, which is good enough a proctection in my case. Does that technique make sense?

  • 2
    Your best bet is to just google "smart card reader for mac" and take a pick and read their documentation for how to implement it. I dare not endorse any product by giving a link but there are just too many options – Purefan Mar 4 '16 at 0:15
  • Thanks, "smart card" is the term I was not aware of here. Are there other types of cards I could use as well? I wonder if there's also a way with RFID based systems? I should probably google that. – Thomas Tempelmann Mar 4 '16 at 0:16
  • you could also use one of the many Two Factor Authentication mechanisms (Google Authenticator is free, for instance) instead of custom hardware for your users – schroeder Mar 4 '16 at 1:53
  • The core problem of RFID tags: You can read them out with your (NFC-capable) smartphone and fake them that way in a matter of seconds. – SEJPM Mar 5 '16 at 19:24

I am not sure if your idea about the database encryption will work the best. But just to give you an idea about your need to use a 2nd factor for the encryption.

Devices or Apps like the Google Authenticator use a one time password algorithm. This is based on a symmetric key. Such an algorithm and device can not be used for encryption.

You want to use asymmetric keys (>= RSA2048) to do the following. Create a key pair of a private and a public key on the smartcard. The private key does not leave the smartcard. The public key does. As it is public. The private key will be unique in hardware, as it does not leave the hardware.

Encrypt your database with a symmetric AES key.

Now you can encrypt the symmetric AES key with the public key. Each time the user wants to access the database you can decrypt the encrypted AES key in the smartcard (with the private key) and the AES encryption key can be used to decrypt the database. Of course you need to take care that the symmetric AES encryption key is not leaked.

But now you can add new users with their own asymmetric key pairs. For each user you can encrypt the AES encryption key with the user's public key. Thus only this user can decrypt the AES encryption key with his private key. And you can manage, which user will be able to decrypt the database.

...if you want to do this all you have a whole long way to go! Have fun ;-)

  • That explains it quite well. I had not thought about using asymmetric encryption on the card, so thanks for bringing that up. I also found now some "smart cards" with CPUs on them to do what you suggest on the card. – Thomas Tempelmann Mar 5 '16 at 18:41
  • I've updated my question to include a technique with RFID cards. That would use hashing. Is that a viable alternative? The only difference to your suggestion is that the RFID code could be copied while the private key on the smart card can not, adding another level of security. Am I right? – Thomas Tempelmann Mar 5 '16 at 18:48
  • related (more advanced) technique to allow database access: Blindable decryption. – SEJPM Mar 5 '16 at 19:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.