2

For learning purposes I am trying to build a web application (Symfony2, PHP) that allows users to post content and have their own password vault, everything encrypted. Since I want to users to be able to share passwords and encrypted content I chose asymmetric encryption for generating a key pair for each user.

I will store users key pairs in the database but I will encrypt each user private key with AES-256. When the user signs in, he should be able to view his passwords and content he has access to without any user extra input.

That's the general idea.

Now to the practical solution.

Create user

  1. Generate 4096-bit keys
  2. Generate session key, PBKDF2(user password)
  3. Encrypt private key with session key
  4. Store key in database

Encrypt content/password

  1. Generate a random storage key
  2. Encrypt password with storage key using AES-256
  3. Encrypt storage key with user public key
  4. Store encrypted storage key

User login

  1. User enters password
  2. Compute session key from password, PBKDF2(user password)
  3. Store session key in session
  4. User requests encrypted content - decrypt storage key with user private key
  5. Decrypt content/password(AES-256) with storage key

As I see it, there are two main disadvantages with this scheme.

  1. I store the decryption key (seesion key) in the users session, which I'm not certain if it is written to /tmp folder. An attacker could perhaps use some form of session hijacking or if he had access to server read the /tmp folder.

  2. The users private key is not passphrase protected!

Solution?

  1. Session encryption? Or maybe that's not needed since symfony2 handles session data sufficiently?

  2. Generate random string to be used as passphrase, encrypt this passphrase and store in the database. Or use PBKDF2(session key) as passphrase ?

The goal is to be able to protect the users passwords & content as much as possible even though the attacker has access to the database or server.

Does my plan sound "good", or should I just scrap it? Any feedback?

  • Interesting Idea but when storing information like this. I have to ask about the database and networking this kind of thing needs to be thought about hardware as well. so tell me about your proposed network. – TheHidden Mar 11 '15 at 22:45
  • @silverpenguin Everything will be open source so whoever wants to use it will have to run it on their own server. – Grimmjow Mar 12 '15 at 9:56
  • my question was being asked because database location is important in a project like this. for example personally I would have the database server on a physically different server on an isolated network with very tight controls with not direct connection to the database creating a series of tight APIs to feed back to the main server as to keep the database credentials away from the front end server. 100 ways to do things but I was just interested in your plan – TheHidden Mar 13 '15 at 9:21
  • @silverpenguin My plan would would be to have everything on one server. Maybe in one virtual machine. But of course, you could separate the two but that would be up to each user. – Grimmjow Mar 13 '15 at 11:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.