I am considering creating a web-based KeePass-like solution in Symfony 3 (PHP) to have the password safe with few other functionalities added. I want to make sure there are no major security flaws. Here are the assumptions:
- Internal company server, internal service
- Website works on HTTPS only
- User first needs to log in (LDAP, company's password policy is quite strict)
- After logging in, user needs to enter encryption password which will be used as the encryption key after being hashed with SHA256 (hash('sha256', $key, true))
- The entered encryption password is checked if valid by comparing a single decrypted value with known expected value
Encryption/decryption methods, used for keeping/retrieving passwords from the DB:
public function encrypt($openText) { $ivSize = mcrypt_get_iv_size(MCRYPT_RIJNDAEL_256, MCRYPT_MODE_CBC); $iv = mcrypt_create_iv($ivSize, MCRYPT_RAND); $encryptedPayload = mcrypt_encrypt(MCRYPT_RIJNDAEL_256, $this->keyHash, $openText, MCRYPT_MODE_CBC, $iv); $encryptedBinary = $iv . $encryptedPayload; return $encryptedBinary; } public function decrypt($encryptedBinary) { $ivSize = mcrypt_get_iv_size(MCRYPT_RIJNDAEL_256, MCRYPT_MODE_CBC); $iv = substr($encryptedBinary, 0, $ivSize); $encryptedPayload = substr($encryptedBinary, $ivSize); $openText = rtrim(mcrypt_decrypt(MCRYPT_RIJNDAEL_256, $this->keyHash, $encryptedPayload, MCRYPT_MODE_CBC, $iv), "\x00"); return $openText; }
Encryption key hash is kept in user session
- User session expires after 120 seconds since last activity
- Passwords are not kept in website HTML - they are read from the server every time using AJAX over HTTPS, temporarily put in HTML element's attribute to be copied by JS, and then the attribute gets removed
- Passwords are copied to clipboard using clipboard.js
- Clipboard is cleared (by copying empty string) after 15 seconds
Do you see any security problems here (considering webapp design, compared to KeePass)? What should I be paying special attention to?