Why am I asking?
I am very new to cryptography (so please be patient with me...) and I want to avoid making unnecessary mistakes. I did a lot of research, but - other than with most other programming related questions - I had a hard time finding enough information to make me confident, that I do now understand how to do things right.
What is the context?
I am working on a webshop using PHP (> 7.2) and MySQL. I need to store some personal information. However, this will not contain critical data (like payment details) - only names, adresses and contact information. Nevertheless, I want to encrypt this data - not least to gain some exprerience. This data will be entered and read by the php application, without input from an admin.
I am hosting this site on World4You, an Austrian provider. I am not sure of the proper word for this (English isn't my native language), but I think you'd call this shared hosting. However, I've read of shared hosting, where other users have access to my files - this is not the case here.
In your answers please consider these circumstances as invariant. I am well aware, that there is quite a bit of room for security-related improvement when it comes to hosting. And I am, of course, happy about every suggestion in regard to this. But please also help me find the best solution given these circumstances.
According to my research, there are stronger encryption alternatives to secretbox. However, this added security can easily be undermined through poor implementation - escpecially if you are an amateur like me. Secretbox is still pretty secure, but much easier to use and therefore the best choice in my case. Correct?
Also, libsodium now comes as a part of PHP (in versions 7.2 and later).
Thanks to the libsodium e-book I now know how to generate a key and a nonce and how to encrypt and decrypt data using these. However, I am not sure about how to store the key and the nonce.
Where do I store the key?
The "best" solution (considering my circumstances), that I found so far, is to store the key in a php-file, that lives outside the document root. Is this an acceptable way of going about things? Are there better options, that don't require significant changes to my setup?
Where do I store the nonces?
In my understanding, nonces do not have to be kept secret. So, where do I keep my nonces?
e.g.: If I want to encrypt the strings for the table-columns "name", "address" and "email", I'd use 3 nonces, right? So, would I just store these 3 nonces in three additional columns of this same table (this somehow intuitively "feels" wrong)? Or would I store them somewhere else?
What column type should I use?
From what I've gathered, I should store the encrypted data in a column of some binary type. So would a BLOB be the right choice?
Also, what column type should I use to store nonces (if I do actually store them in a table)?
Thank You very much!