I need to implement a web application for user to update personal information. It consists of a page listing masked personal information and then a button which allows user to edit & update them.

I think the list function should be done by invoking API #1 to retrieve encrypted personal information and the corresponding plain but masked personal information. And the update function is done by invoking another API #2 (same API provider) with updated values and the other non-updated encrypted personal information for updating user profile. Because API #2 requires full set of data besides the updated pieces.

Am I correct? How to securely implement the encryption? Per-user symmetric key with login name & login timestamp? Or generate a session key randomly for every login session? Any hashing needed?

  • You only describe your idea of a solution but you don't actually describe the problem you want to solve in enough detail (just "implement a web application for user to update personal information" is too broad). It is impossible to evaluate your solution if it is not known which problem it tries to solve. – Steffen Ullrich Mar 23 at 16:57
  • @Steffen Ullrich : Edited the question and supplemented more. – bboy Mar 23 at 17:23
  • Are these API's controlled by the same party? In this case the a static encryption key can be used which is only known to this party. There is no need for user specific encryption since the encrypted content will not be seen by the user anyway. – Steffen Ullrich Mar 23 at 18:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.