Re: getting started with encryption

From	bill <william@TechServSys.com>
Newsgroups	comp.lang.php
Subject	Re: getting started with encryption
Date	2014-10-12 11:17 -0400
Organization	Aioe.org NNTP Server
Message-ID	<m1e62v$99h$1@speranza.aioe.org> (permalink)
References	(1 earlier) <m1bf9k$hv4$1@dont-email.me> <m1bfl8$dka$1@speranza.aioe.org> <c9t4nvFhpigU1@mid.individual.net> <m1dre8$g83$1@speranza.aioe.org> <c9vfbuF5eg6U1@mid.individual.net>

Show all headers | View raw

On 10/12/2014 9:52 AM, J.O. Aho wrote:
> On 12/10/14 14:15, bill wrote:
>> On 10/11/2014 12:38 PM, J.O. Aho wrote:
>>>
>>> Session data stored in persistent storage will give the
>>> unauthorized 3rd party all they may need to decrypt the database.
>>> A brute force attack will be a lot simpler when just need to
>>> figure out a string.
>>
>> Would you be so kind as to expand on this theme ?
>
> Assumption based on your earlier descriptions:
> - Decryption/encryption is done in the web application layer
> - Password for decrypt/encrypt is valid for a 3 hour session
>
> You need to store the session somewhere,
> using the session() which is used by php it will by default store
> the session data on disk. As it's on disk, it's easy to just open
> the session file and read the password from it and the third
> party has full access to the data.
>
> Even if you manage to delete or keep the session data out of
> reach for the 3rd party, it's simple to write a brute force
> script which can try to figure out the password trying dictionary
> words and random characters, as there will be no mechanism to
> prevent unlimited tries. [figure out a string]
>
>
> Using encryption keys which are handled by the database, you have
> something that is more difficult to generate, a valid key and the
> database may lock the user which tries more than X times with the
> wrong key.

I understand that.  Changing databases in a reasonably short 
amount of time would be a problem.  I didn't use a database 
abstraction layer so that would be a major rewrite.  Maybe for 
the next version (due in 2020).

Although it seems paradoxical, would keeping the key in a cookie 
on the client machine be more secure? (assuming the cookie is 
overwritten at timeout or logoff) It would involve a lot of 
transmitting the key to the server, but this is over a physically 
secure LAN or hardware VPN.  The thought of that makes me 
shudder, but.....
It would address the issue of physical theft of the server.

-bill

Thread

getting started with encryption bill <william@TechServSys.com> - 2014-10-10 14:46 -0400
  Re: getting started with encryption Matthew Carter <m@ahungry.com> - 2014-10-10 16:36 -0400
  Re: getting started with encryption John-Paul Stewart <jpstewart@sympatico.ca> - 2014-10-10 18:53 -0400
  Re: getting started with encryption "J.O. Aho" <user@example.net> - 2014-10-11 09:07 +0200
    Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-11 07:59 -0400
  Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-11 10:36 -0400
    Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-11 10:42 -0400
      Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-11 11:45 -0400
      Re: getting started with encryption "J.O. Aho" <user@example.net> - 2014-10-11 18:38 +0200
        Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-11 15:16 -0400
          Re: getting started with encryption "J.O. Aho" <user@example.net> - 2014-10-12 10:53 +0200
            Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-12 08:17 -0400
              Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-12 08:47 -0400
                Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-12 11:04 -0400
                Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-12 11:13 -0400
                Re: getting started with encryption "J. Clarke" <jclarkeusenet@cox.net> - 2014-10-12 15:12 -0400
                Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-12 21:45 -0400
              Re: getting started with encryption "J.O. Aho" <user@example.net> - 2014-10-12 15:53 +0200
                Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-12 10:07 -0400
                How - off topic bill <william@TechServSys.com> - 2014-10-12 11:05 -0400
                Re: How - off topic "J.O. Aho" <user@example.net> - 2014-10-12 17:27 +0200
                Re: How - off topic Denis McMahon <denismfmcmahon@gmail.com> - 2014-10-12 17:23 +0000
                Re: How - off topic Tim Streater <timstreater@greenbee.net> - 2014-10-12 18:49 +0100
                Re: How - off topic bill <william@TechServSys.com> - 2014-10-13 09:24 -0400
                Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-12 11:01 -0400
                Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-12 11:19 -0400
                Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-13 08:38 -0400
                Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-13 09:18 -0400
                Re: getting started with encryption - now off topic with gratuitous insults bill <william@TechServSys.com> - 2014-10-13 10:36 -0400
                Re: getting started with encryption - now off topic with gratuitous insults Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-13 12:14 -0400
        Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-12 08:15 -0400
          Re: getting started with encryption "J.O. Aho" <user@example.net> - 2014-10-12 15:52 +0200
            Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-12 11:17 -0400
              Re: getting started with encryption "J.O. Aho" <user@example.net> - 2014-10-12 17:45 +0200
                Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-13 08:58 -0400
                Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-13 09:23 -0400
                Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-13 10:44 -0400
                Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-13 12:20 -0400
                Re: getting started with encryption "J.O. Aho" <user@example.net> - 2014-10-15 21:52 +0200
                Re: getting started with encryption gordonb.1o7q6@burditt.org (Gordon Burditt) - 2014-10-16 12:13 -0500
                Re: getting started with encryption Matthew Carter <m@ahungry.com> - 2014-10-16 15:25 -0400
                Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-18 08:13 -0400
                Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-18 07:52 -0400
                Re: getting started with encryption "J.O. Aho" <user@example.net> - 2014-10-18 14:46 +0200
                Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-19 07:47 -0400
  Re: getting started with encryption Denis McMahon <denismfmcmahon@gmail.com> - 2014-10-12 17:30 +0000
    Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-13 08:59 -0400

csiph-web