I'm designing the security of a new application and try to figure out what the best way is to store the keys of the mysql AES encryption in the file system. I've seen several options like store it outside webdirectory in a restricted dir in the filesystem. Also you can store the key in system memory (how do you do this and how do you use it in php/mysql)? So my thoughts were, why not write a custom php extension with a hashing function and also the key store, and restrict the use of this custom functions on the servers ip address. Then this custom extension get compiled and loaded in apache.

Is the above safe? Can a php extension can be decompiled? What if a hacker gets access to the server and runs a php script that makes use of this custom function? (or like the other option: reads the key stored in the filesystem)

Btw: the webserver+db and secure db will be 2 seperated servers.

Hope somebody can help out! Thank you :)

  • Sorry, what are you encrypting and how? Do you really need reversible encryption or are you hashing passwords? Everything can be reverse engineered / decompiled.
    – GBC
    Mar 11 '13 at 11:30
  • Mainly sensitive data will be encrypted, must be 2 way. Mar 12 '13 at 11:35
  • It don't feels very secure when the main encryption key is on the file system, when a hacker get control over the server he can decrypt the sensitive data on the seperate database server Mar 12 '13 at 11:36

A PHP extension is just compiled code. If the attacker can see the compiled code, then he can, indeed, decompile it. A key stored in compiled code that the attacker can see, cannot be considered as really secret. Otherwise, DRM would be a solved problem.

Storing the key in a "restricted directory" is a good idea (you don't want the key to be retrievable with a simple subverted GET); using a custom extension and putting the extension DLL itself in that restricted directory won't offer substantially more security. That extension would be the aggregate of the key, and the cryptographic algorithm which uses the key. It is sane practice to assume that the attacker already knows the algorithm (that's Kerckhoffs's principle), so you are back to storing the key in that directory.

Therefore, I would advise against the custom extension, because it does not bring security benefits, but it adds complexity (and complexity is bad).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.