1

I have a requirement where i need to store confidential data in an encrypted format in the url, i understand POST with body is better approach but it is not an option for me. I am thinking of using a pass phrase based AES 128 bit encryption for encrypting the query string parameter. The concern i have is that the url could get cached in different parts of the internet and if the pass phrase is exposed somehow then it could be used to decrypt these values. Are there any encryption mechanisms which allow to decryption to happen only within our infrastructure? Is there a way to tie the decryption to our infrastructure along with the key so that even if key is lost nobody outside can decrypt it?

3
  • 4
    You have not said who needs to encrypt or decrypt. The client? The server? Both? But in general, if you want to keep your keys in a physical datacenter, you probably want something like an HSM.
    – Marc
    Commented Jun 28, 2020 at 16:30
  • @Marc The encryption of the query string parameter will be done on the server side. My requirement once again if it was not clear is to store PHI information of a patient(Name, DOB etc) in encrypted(on server side) form in url as query string parameter, users can bookmark if needed the link to a specific patient and when they click the link, we will decrypt the query string parameter on server side, search and send back the results to be displayed in our single page application. The other approach is to store this info in a database table which i am trying to avoid, i do not have a db now. Commented Jun 28, 2020 at 22:38
  • Why aes 128 instead of aes 256?
    – john doe
    Commented Jun 29, 2020 at 15:20

3 Answers 3

1

The encryption of the query string parameter will be done on the server side. My requirement once again if it was not clear is to store PHI information of a patient(Name, DOB etc) in encrypted(on server side) form in url as query string parameter, users can bookmark if needed the link to a specific patient and when they click the link, we will decrypt the query string parameter on server side, search and send back the results to be displayed in our single page application. The other approach is to store this info in a database table which i am trying to avoid, i do not have a db now.

Even if we assume that you get an absolutely perfect encryption method that can only be decrypted by a magic crystal on premise in your datacenter, when your application is commercially successful, it will run for years.

Two or three years down the road, someone will find a way to break your encryption. Now you can obviously react and upgrade your encryption for future links you give out, but now there are two or three years worth of links out there that are vulnerable and their data will leak. There is no way to patch those links once you gave them out.

What you need to do is remove all the information from the link, give it a unique but random id and save the information and the id in your database. You can even save which user should have access to which links.

"I don't have a database yet" is not a design decision, it's an excuse. You need one, so go use one.

0

All decryption is only possible if you have the key (or sufficient computing power and time). If you want to be sure that the key never leaves the infrastructure, buy a Hardware Security Module (HSM) (Thales, Utimaco and some others). These are hardware devices that allow you to do the decryption. There are many types, some (many?) including tilt and motion sensors.

But at some point, you might want to rethink your strategy. HSMs are really a niche market, and in my 25+ years experience, I've seen just 1 case where they were really necessary.

If you pass data over the Internet, surely the goal of that data sharing would be that the other party can use that data? Then, if the data at the other party is "exposed somehow", all is lost anyway.

Or do you just not want that the data leaves the data centre? In that case: try using a stand-alone system.

If you're communicating with a single (or limited number) of partners, symmetric keys would also be an option. Key management would be doable.

0

Are there any encryption mechanisms which allow to decryption to happen only within our infrastructure?

No. Your only means of controlling this is controlling the keys. If the keys leak, anyone who has the ciphertext can decrypt it anywhere.

Also if you are transferring encrypted data, surely someone else needs keys to decrypt it? So with AES that's a minimum of 2 parties with keys now.

Is there a way to tie the decryption to our infrastructure along with the key so that even if key is lost nobody outside can decrypt it?

See above - not really. There could be methods and mechanisms that contribute towards this end, and it may be possible to develop something, but ultimately who has keys can decrypt the material.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .