We store user email addresses in our database, like many other websites. While we do take pride in the security measures in place, sometimes "just enough" is just not enough.
We've begun looking into a solution which would let us store the email addresses in an encrypted format, and retrieve them in a readable format, but - and here's the catch - outside the source of our PHP code. That is, should someone ever breach our servers and retrieve our source code, our database passwords and everything to do with our business intelligence, we would like him to still have utterly useless data without the encryption algorithm.
What would be the best way to go about this, and are there any readymade solutions? We were thinking something along the lines of a php or apache module, or even a little Go program - anything compiled which would execute very fast and would be unusable if stolen because of its compiled nature.
What we want is something like this:
The emails in the database would be stored in this format
Then, when we did this:
$email = $db -> getEmailById(30);
$email = decrypt($email);
the decrypt function would to the actual decryption, but outside php. It could call the system command and execute a binary file, whatever. But whatever decrpyt returns is the actual usable email then.
This decrypted email can then be used as the recipient of a system-sent email, or as displayed contact information on a user's profile, etc, but if the user nicks the DB somehow, all he sees is the above gibberish.
Edit: tdammers asked why this has to be outside PHP but callable from within PHP. Because we use the actual values of the email addresses a couple thousand times per minute, different ones at that. So our web app needs fast access to the readable values at all times, but we need to be sure that should someone grab our source code somehow or the database itself, he won't have any usable values. This can be anyone from a hacker, to a part of the code becoming exposed due to a critical bug, or a disgruntled ex-employee 5 minutes after getting fired leaving us no time to revoke his access.