I'm storing a list of email addresses and other not personally identifiable information for a mailing list in a database. Since it's for a project related to cryptocurrency, I believe that the information could be a target for future attack. Specific scenarios I am aiming to protect against:
- Someone in the shared hosting environment or a server administrator (for example, rogue employee) decides to copy the email addresses to sell on the dark web, where it could be used for phishing.
- A part of the site or service is vulnerable to some kind of exploit that inadvertently gives access to the database. (Despite my best practices and careful development I left one single page open to SQL injection, for example.) This gets exploited by an attacker to get emails and phish the site members.
- The server becomes vulnerable due to an exploit elsewhere on another shared hosting account, which is then able to gain elevated privileges and access the database using high level server access.
- A backup service is used in the future, and this stores data insecurely or is not trustworthy, thus resulting in the copy of the backup being accessed and members getting phished.
- At some point, the wrong individual is trusted to develop a feature of the site - either given access due to high trust or providing code with a backdoor that isn't noticed in careful inspection of provided code.
The above could be extremely damaging to the project. I'd like to ensure that the plain text email addresses can't be accessed in those or similar scenarios, should all other protection mechanisms and best practices fail.
The email addresses will only be used for a periodic newsletter, so there is no need to have persistent access to the information. The idea I have is to encrypt the email addresses using a secure private key that's stored offline and only accessible to me. I would use the key to decrypt the email addresses only when sending the newsletters, and otherwise email addresses would remain encrypted.
I had some basic questions:
Which encryption algorithms make sense? I'd like something that's easy to work with in PHP, been around for a while, and that there aren't any known exploits.
One issue is that new email address would have to be encrypted when a person signs up. I could leave them in plaintext for a period of time, but my concern is that's going to be a pain to keep doing and I might not get around to encrypting them quickly. Is there such a thing as an algorithm where one key can be used to encrypt the information, which is different from the decryption key? ie The decryption key works to decrypt any secret, but the encryption key is one-way only. I was curious if this is possible.
Bonus points if someone can provide some simple PHP examples that I could play with. That would be really awesome!
Note: I have checked out some other pages:
Mysql - two-way encryption of sensitive data (email addresses) outside of Apache, PHP and MySQL seems like quite a different use case, since they need continual access which I do not
Encrypting email addresses in php wants hashing, and also continual access which I do not
Thanks so much for your help and insight!