I'm building a database that symmetrically encrypts user data. Nothing super sensitive, I'd use a third-party if it was. The data is encrypted with a surrogate key; the user must enter a password to decrypt the data. An evil DBA cannot view the data as it's encrypted. Pretty standard so far.

Given that only the user password (or rather, its hash) can decrypt database records, I need to somehow pass it across the session. So:

  • I create my own unique session ID and store it in the database, in table "session". The same value is stored as a cookie in the user's machine ("user_session").
  • The database also contains a random key associated with that session ID. Another cookie, "user_pass", holds a XOR result of a hash of this random key and a hash of the user's password.
  • When the user queries the encrypted database, the program XORs the "user_pass" cookie with the random key in the database -> arrives at the hash of the user password -> decrypts the db records. This way, no complete password data is stored on the server (in a temp session directory or in the database), nor in the user's machine.

Is this the standard way of storing a key across the session? remember it's used to decrypt the database records. Assume we're using SSL.

Vulnerabilities with DB backed session tokens and Is it safe to store password in PHP session? discuss this but don't fully answer my question.

Your Answer


By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.