**Scenario**

- Master key is entered upon login then encrypted with `$server_key`
- Master key is now stored as `$_COOKIE['encrypted_key']` variable for persistence (so user doesn't have to enter it every page load)
- `$server_key` is stored inside a config file in the app server
- Data is decrypted by first decrypting `$_COOKIE['encrypted_key']` (using `$server_key`), therefore revealing Master key
- `$_COOKIE['encrypted_key']` is destroyed upon browser exit

**Threat**

Attacker gaining access to user device/cookie and encrypted data (but not the app server config files).

**Question**

Does it make sense to encrypt the Master key with `$server_key` and then store `$server_key` inside a config file in the app server?

**Reasoning**

Gaining just the `$server_key` or just the `$_COOKIE['encrypted_key']` will not compromise anything. The attacker must get both.