Securing sensitive data.

– Charlie Brown 13 October 2009

If I steal your web server how secure is all that encrypted data on the drive? The answer is usually "not at all". That's because the all-too-common method for encryption in web applications also stores the decryption key, unsecured, on the same server. Get the server, get the key. Get the key, get the data. It's that simple. The argument in favor of this method says that the key has to be there for the server to encrypt the data. Perhaps it's a coincidence that it's also a lot easier, and, speaking from personal experience, programmers are lazy by nature.

So that begs the question, "Is there a way that would keep the data secure even if the attacker has full access to the server?" Yes - and it's not new. It's just harder than the one-key-fits-all method. You have to blend one-key (Symmetric) encryption with two-key (Public Key) encryption.

Encryption:

1. random 256-bit AES key generated - 128-bit is plenty strong enough, but hey, why not?
2. random key used to encrypt the data
3. RSA Public Key is used to encrypt the Random Key
4. both the encrypted data and the encrypted key are stored in the database.

Decryption:

1. login pass-phrase is strengthened into a 256-bit AES key
2. strengthened key is used to decrypt that user's RSA Private Key
3. RSA Private Key is used to decrypt the AES (Random) Key
4. AES Key is used to decrypt the data.

Note that although the encryption key is stored on the server, it is encrypted and, more importantly, cannot be decrypted using anything on the server.

Since the whole decryption phase is kicked off with the user's login pass-phrase, an attacker would have to have that in addition to the encrypted data in order to get anywhere.

Most new PHP installations have everything you need:

• mcrypt-encrypt
• mcrypt-decrypt
• openssl-public-encrypt
• openssl-private-decrypt

If you're collecting sensitive information on your wesite (or websites that you've developed), you should be securing it properly. If you are not, or are not sure, give us a call. Let us discuss with you how Dialogs can empower you to securely work the web.