7

I'm working with the php-encryption library to provide integration between two different applications. On one side, I have a corporative application that holds all data from users. This application will serve some sensitive data through an API.

On the other side, the other application will request some data, consuming the API. At this point, the API is using authenticated encryption to keep the data secure.

The question with the php-encryption library is: the key of encryption is a random key. I need keep that key because the other application must decrypt the data.

Example:

To encrypt:

$key = Crypto::createNewRandomKey();

$message = "mymessage";

$ciphertext = Crypto::encrypt($message, $key);

To decrypt:

$decrypted = Crypto::decrypt($ciphertext, $key);

What is the best way to share the key or keep the same key between different applications?

5
  • 2
    I take it you aren't familiar with public key cryptography? May 10, 2016 at 19:56
  • 1
    PKI might be the solution to your problem. Are there reasons why you need to create a new key for every message you want to send?
    – schroeder
    May 10, 2016 at 20:27
  • @schroeder, No. There's no Reasons to generate a new key for every message. It's how the library works. I changed the behavior of the keys generation, but it's a bad practice. PKI / Public Key are really good options, I'll read more about. I always thought that authenticated encryption would be the best option in this case. Maintain a fixed key in both applications would be a bad practice?
    – Hugo Dias
    May 11, 2016 at 5:59
  • 1
    Authenticated encryption is somewhat confusingly named. It means that you can verify that the cipher text (the encrypted message) hasn't been tampered with. Using PKI is a good way to move forward: encrypt the secret key on server A using public key of server B. On server B decrypt the key using the private key, and decrypt the message with the decrypted key. This leaves the library's usage intact. Consider using lib sodium: paragonie.com/book/pecl-libsodium/read/05-publickey-crypto.md
    – NSSec
    May 11, 2016 at 6:45
  • 1
    It's worth noting that version 2 of the referenced library just came out, so key management is a bit easier: paragonie.com/blog/2016/05/… - That said, it sounds like you're looking for a problem solved by public key cryptography, for which I strongly recommend libsodium. May 19, 2016 at 0:39

1 Answer 1

3

As @schroeder recommended, you should share the key between applications/servers using Public Key Infrastructure (PKI). It's not recommended that you implement this yourself.

There is a great article called Choosing the Right Cryptography Library for Your PHP Project. This is worth taking a look at. It recommends the following libraries:

  • Halite
  • Libsodium (as recommended by @NSSec)
  • PHP Encryption
  • Phpseclib (RSA! Only)

Others to consider:

  • EasyRSA (Not PKCS#1v1.5!)
  • phpseclib

Also since there are corporative apps involved, have a strategy for key management on the respective servers (i.e. key management processes and policies, use of a Hardware Security Module (HSM), etc). You can also consult Guidance for Securing Public Key Infrastructure.

Good luck with your project!

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .