I am using AES encryption to secure some sensitive data. For that i have to provide a certain key for encrypting and decrypting.

It's not safe to keep the key somewhere on the server. So instead of entering the key directly, I would like to convert the key and later convert it back again to it's original when entering it while encrypting or decrypting the value.

I thought of doing the key conversion via PHP. Is it a good practice or are there any other suggestions?

closed as unclear what you're asking by NULLZ, TildalWave, Adi, Lucas Kauffman, Xander Jul 25 '13 at 13:18

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    Can you please clarify your example and use case, we can then provide a more robust answer or link to an existing answer that will meet your needs. – Eric G Jul 25 '13 at 3:45

Depending upon your budget, you may want to look as a hardware security module. This would be a device connected to the server which stores the key and does encryption, it not part of the operating system and it would more or less be like magic black box.

You could also use another server which has the sole purpose of doing crypto, and again functions as a black box. With a very tight firewall config and other checks, this may also be effective.

  • i thought of setting the key in configuration file and use it directly as the key.But in the case somebody get that key it may be misused and harm the application.So instead of that before using the key converting it into any other say for example as its ascii value and use it as the key.Thats what i thought of doing – Deepu Jul 25 '13 at 3:57
  • 1
    I am having a bit of trouble following you, but it sounds like you are just using a new value with the same problem. If you have a local algorithm, script, or program that runs locally, then if someone breaks into you box, they can follow the same steps. Obfuscation is not security. – Eric G Jul 25 '13 at 4:01

Do you think every vulnerability immediately gives an attacker full access to your application?
Hell no!

So, how are applications exploited? SQL Injection is very common, and if you have SQL injection in an application you should have full read access to the database. That means you can read encrypted values. So what about the key? Well, an attacker might be able to gain access to the key using a MySQL load_file(), but not if the application was built properly. MySQL shouldn't even be on the same system, and if your DBA has any security sense, the web app wont' have file_priv.

But even more to the point, secrets can be stored in places that are not in accessible files, for example: environment variables. File system privileges can be used to make files executable, but not readable or writable from an attacker. Encryption is about planning on failure, and using an attacker's weakness against them.


KISS principle: put the password in a text-file on an USB stick or some similar storage unit.

That separates the encrypted data from the related key, and you can have the key "on you" whenever you need it. This way, you don't have to remember the key, or come up with some wild obfuscation theory that is bound to fail.

All you need to remember is where you've put that USB stick (or alike storage unit) and protect that from being stolen or copied. You can trust in the fact that it'll be much easier to protect a storage device in your pocket than trying to make sure your key is safe on some server, next to the encrypted data.

"Keep It Simple and Safe" ~ http://en.wikipedia.org/wiki/KISS_principle

  • 3
    Its not very useful on a USB stick if you are encrypting values on a web app... – rook Jul 25 '13 at 5:33
  • @Rook Erm, say what? Since when does a web-app expect a crypto-key to be permanently stored on the web server when it's not permanently used for web-app functionality, but only for admin purposes every now and then? Note that OP currently stores the key on the server to manually enter that key whenever he may need it and OP asks if that's safe or if there's a better way to store the key. Nothing in the question says that any web-app expects the key to be available on the server all the time! Re-read the question: OP describes that the key does not need to be available all the time. – e-sushi Jul 25 '13 at 15:05

Not the answer you're looking for? Browse other questions tagged or ask your own question.