Linked Questions

8
votes
5answers
9k views

Where do I securely store application-specific symmetric key?

I am writing an application App1. This application uses SQLite database and I plan to encrypt it using AES256. For symmetric encryption I need a key, which I need to store somewhere. From a similar ...
15
votes
2answers
2k views

How to use AWS KMS securely?

I am investigating using AWS KMS (Amazon Web Services Key Management Service) to decrypt an encrypted symmetric key (i.e: envelope encryption). However, to use the KMS, I need to pass it my amazon ...
7
votes
3answers
4k views

Is it a secure way to declare DB parameters in htaccess rather than in a PHP file?

It has been suggested in securing PHP article that using directive as below in htaccess is more secure than hardcoding it into your app: <VirtualHost ilia.ws> Include /home/ilia/sql.cnf </...
4
votes
4answers
2k views

Where to store a key for system wide encryption/decryption?

I have a web application where (among other things) customers can upload files and administrators can then download those files. The uploaded files are stored on ServerA and the web application used ...
4
votes
3answers
1k views

Is it secure to centralize database information?

I would know if it is secure to centralize database information into one file like this : db_infos.php: $server = "localhost"; $user = "root"; $password = "1234"; $database = "foo"; $table = "bar"; ...
3
votes
2answers
2k views

How to store an encryption key on shared hosting?

I am designing a simple online patient management system that is running on shared hosting. According to national regulation sensitive data should be encrypted when used online, so I have encrypted ...
3
votes
1answer
6k views

Need advices on API key & secret generation?

While working on a Java project using Spring-boot, Spring-security and JWT token, I need to provide access via API key and secret. After searching on Google for a while about key/secret generation, ...
11
votes
1answer
4k views

Storing OAuth and other authentication tokens

We all know that when to store passwords, we should store it with one-way hash such as a variant of SHA, bcrypt or scrypt to prevent plain-text password leaks when the database is hacked. But what ...
1
vote
2answers
2k views

How can I safely store a password in a .class file?

I have some .java files containing some password variables, and these variables have values: String password = "xyz"; Now after run, when I open the .class file, it contains those passwords. How can ...
0
votes
2answers
2k views

How to store an AES Key? an Initialization Vector(IV)?

I'm currently developing an authentication service for our company. I somehow understand how to store a salt used in hashing a password in that it should be stored together with the hashed password. ...
1
vote
1answer
2k views

Storing data encryption key in the DB. Safe or not?

I'm currently taking over a service and while looking through the DB, I noticed that we encrypt some of our data using a function in the DB where the encryption key is hardcoded in the DB function. ...
1
vote
1answer
985 views

Is it secured to store the encrypted key in the database (encrypted by other cipher)?

I want to improve the encryption flow used by my application. Today I use the AES cipher while its key and its IvBuffer are hardcoded in the code. I know it is not secured and I want to improve this. ...
0
votes
3answers
366 views

What benefit to use different encryption key (passphrase) for different customers?

When we store confidential information in our database, we encrypt it using AES. In addition, when customers install our product, they protect their machines using a firewall. Should we use different ...
0
votes
2answers
928 views

How secure is encrypting & decrypting strings with OpenSSL? [closed]

I am wondering how secure it is to encrypt and decrypt strings using OpenSSL using Salts and an Initialisation Vector. If the salt and initialisation vector are both going to be stored in a database ...
2
votes
3answers
267 views

How should SSL traffic be treated once it has been terminated?

Ideally, how should SSL traffic be treated once it has been terminated at an SSL appliance especially if the traffic contains sensitive information like personal financial information before it's ...

15 30 50 per page