I am self training on using encryption. I am a php developer and in my spare time I am building an online app that provides basic cms features to help me understand encryption design more. I am using encryption to protect the data if stolen and having it accessible to public like what happened to adobe.
My restrictions for this app are:
End users will be using this app and cannot be trusted to remember their password all the time so their password cannot be used in the encryption process as there will be a high chance that they will need to reset their password at some stage.
Cannot afford vendor key management software or hsm.
Cannot have users loading in a key when logging into cms to encrypt or decrypt data during session. In fact users will not have any access to the keys used as they cannot be trusted to keep keys safe. Plus external users such as contractors will have access to cms. So all keys managed by app under the covers.
The data will be stored in a db encrypted. The code will encrypt the data as I am not using the native encryption of mysql.
The data will be encrypted using a symmetric key.
The symmetric key will be stored on another server that is firewalled off and only callable via cms ip. The cms when it needs a particular symmetric key will call the server which stores the symmetric keys and pass a hash value that will be used to look up the correct symmetric key. When the key is located it will send the key back to the cms and the cms will store the key in memcached.
Now I was thinking that I need to protect the symmetric keys so what I thought I should do is encrypt the symmetric keys with asymmetric public key and store the encrypted symmetric key in a db on the non cms server then when the cms gets the key it uses the private key stored on the cms server to decrypt it.
It's like chicken/egg!
I was wondering if anyone can give me some guidance on how to do this correctly. My goal for this project is to protect the data if the db is stolen.
I think it's bad to store the private key on the cms server because if the non cms server which stores the symmetric keys used to encrypt the data is also hacked then all the keys are available.
The app will also be checking inputs for injection attempts, Xss, using ip whitelisting for accessing cms, encrypting session cookie, cleaning input data and other basic security fundamentals.