6

I'm working with the php-encryption library to provide integration between two different applications. On one side, I have a corporative application that holds all data from users. This application will serve some sensitive data through an API.

On the other side, the other application will request some data, consuming the API. At this point, the API is using authenticated encryption to keep the data secure.

The question with the php-encryption library is: the key of encryption is a random key. I need keep that key because the other application must decrypt the data.

Example:

To encrypt:

$key = Crypto::createNewRandomKey();

$message = "mymessage";

$ciphertext = Crypto::encrypt($message, $key);

To decrypt:

$decrypted = Crypto::decrypt($ciphertext, $key);

What is the best way to share the key or keep the same key between different applications?

  • 2
    I take it you aren't familiar with public key cryptography? – Steve Sether May 10 '16 at 19:56
  • 1
    PKI might be the solution to your problem. Are there reasons why you need to create a new key for every message you want to send? – schroeder May 10 '16 at 20:27
  • @schroeder, No. There's no Reasons to generate a new key for every message. It's how the library works. I changed the behavior of the keys generation, but it's a bad practice. PKI / Public Key are really good options, I'll read more about. I always thought that authenticated encryption would be the best option in this case. Maintain a fixed key in both applications would be a bad practice? – Hugo Dias May 11 '16 at 5:59
  • 1
    Authenticated encryption is somewhat confusingly named. It means that you can verify that the cipher text (the encrypted message) hasn't been tampered with. Using PKI is a good way to move forward: encrypt the secret key on server A using public key of server B. On server B decrypt the key using the private key, and decrypt the message with the decrypted key. This leaves the library's usage intact. Consider using lib sodium: paragonie.com/book/pecl-libsodium/read/05-publickey-crypto.md – NSSec May 11 '16 at 6:45
  • 1
    It's worth noting that version 2 of the referenced library just came out, so key management is a bit easier: paragonie.com/blog/2016/05/… - That said, it sounds like you're looking for a problem solved by public key cryptography, for which I strongly recommend libsodium. – Scott Arciszewski May 19 '16 at 0:39
3

As @schroeder recommended, you should share the key between applications/servers using Public Key Infrastructure (PKI). It's not recommended that you implement this yourself.

There is a great article called Choosing the Right Cryptography Library for Your PHP Project. This is worth taking a look at. It recommends the following libraries:

  • Halite
  • Libsodium (as recommended by @NSSec)
  • PHP Encryption
  • Phpseclib (RSA! Only)

Others to consider:

  • EasyRSA (Not PKCS#1v1.5!)
  • phpseclib

Also since there are corporative apps involved, have a strategy for key management on the respective servers (i.e. key management processes and policies, use of a Hardware Security Module (HSM), etc). You can also consult Guidance for Securing Public Key Infrastructure.

Good luck with your project!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.