I'm building a database that symmetrically encrypts user data. Nothing super sensitive, I'd use a third-party if it was. The data is encrypted with a surrogate key; the user must enter a password to decrypt the data. An evil DBA cannot view the data as it's encrypted. Pretty standard so far.
Given that only the user password (or rather, its hash) can decrypt database records, I need to somehow pass it across the session. So:
- I create my own unique session ID and store it in the database, in table "session". The same value is stored as a cookie in the user's machine ("user_session").
- The database also contains a random key associated with that session ID. Another cookie, "user_pass", holds a XOR result of a hash of this random key and a hash of the user's password.
- When the user queries the encrypted database, the program XORs the "user_pass" cookie with the random key in the database -> arrives at the hash of the user password -> decrypts the db records. This way, no complete password data is stored on the server (in a temp session directory or in the database), nor in the user's machine.
Is this the standard way of storing a key across the session? remember it's used to decrypt the database records. Assume we're using SSL.