Re: getting started with encryption

From	"J.O. Aho" <user@example.net>
Newsgroups	comp.lang.php
Subject	Re: getting started with encryption
Date	2014-10-12 15:52 +0200
Message-ID	<c9vfbuF5eg6U1@mid.individual.net> (permalink)
References	<m199hi$mh4$1@speranza.aioe.org> <m1bf9k$hv4$1@dont-email.me> <m1bfl8$dka$1@speranza.aioe.org> <c9t4nvFhpigU1@mid.individual.net> <m1dre8$g83$1@speranza.aioe.org>

Show all headers | View raw

On 12/10/14 14:15, bill wrote:
> On 10/11/2014 12:38 PM, J.O. Aho wrote:
>>
>> Session data stored in persistent storage will give the
>> unauthorized 3rd party all they may need to decrypt the database.
>> A brute force attack will be a lot simpler when just need to
>> figure out a string.
>
> Would you be so kind as to expand on this theme ?

Assumption based on your earlier descriptions:
- Decryption/encryption is done in the web application layer
- Password for decrypt/encrypt is valid for a 3 hour session

You need to store the session somewhere,
using the session() which is used by php it will by default store the 
session data on disk. As it's on disk, it's easy to just open the 
session file and read the password from it and the third party has full 
access to the data.

Even if you manage to delete or keep the session data out of reach for 
the 3rd party, it's simple to write a brute force script which can try 
to figure out the password trying dictionary words and random 
characters, as there will be no mechanism to prevent unlimited tries. 
[figure out a string]

Using encryption keys which are handled by the database, you have 
something that is more difficult to generate, a valid key and the 
database may lock the user which tries more than X times with the wrong key.

> Thanks for the Cornucopia link.

Np.

-- 

  //Aho

Thread

getting started with encryption bill <william@TechServSys.com> - 2014-10-10 14:46 -0400
  Re: getting started with encryption Matthew Carter <m@ahungry.com> - 2014-10-10 16:36 -0400
  Re: getting started with encryption John-Paul Stewart <jpstewart@sympatico.ca> - 2014-10-10 18:53 -0400
  Re: getting started with encryption "J.O. Aho" <user@example.net> - 2014-10-11 09:07 +0200
    Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-11 07:59 -0400
  Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-11 10:36 -0400
    Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-11 10:42 -0400
      Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-11 11:45 -0400
      Re: getting started with encryption "J.O. Aho" <user@example.net> - 2014-10-11 18:38 +0200
        Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-11 15:16 -0400
          Re: getting started with encryption "J.O. Aho" <user@example.net> - 2014-10-12 10:53 +0200
            Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-12 08:17 -0400
              Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-12 08:47 -0400
                Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-12 11:04 -0400
                Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-12 11:13 -0400
                Re: getting started with encryption "J. Clarke" <jclarkeusenet@cox.net> - 2014-10-12 15:12 -0400
                Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-12 21:45 -0400
              Re: getting started with encryption "J.O. Aho" <user@example.net> - 2014-10-12 15:53 +0200
                Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-12 10:07 -0400
                How - off topic bill <william@TechServSys.com> - 2014-10-12 11:05 -0400
                Re: How - off topic "J.O. Aho" <user@example.net> - 2014-10-12 17:27 +0200
                Re: How - off topic Denis McMahon <denismfmcmahon@gmail.com> - 2014-10-12 17:23 +0000
                Re: How - off topic Tim Streater <timstreater@greenbee.net> - 2014-10-12 18:49 +0100
                Re: How - off topic bill <william@TechServSys.com> - 2014-10-13 09:24 -0400
                Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-12 11:01 -0400
                Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-12 11:19 -0400
                Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-13 08:38 -0400
                Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-13 09:18 -0400
                Re: getting started with encryption - now off topic with gratuitous insults bill <william@TechServSys.com> - 2014-10-13 10:36 -0400
                Re: getting started with encryption - now off topic with gratuitous insults Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-13 12:14 -0400
        Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-12 08:15 -0400
          Re: getting started with encryption "J.O. Aho" <user@example.net> - 2014-10-12 15:52 +0200
            Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-12 11:17 -0400
              Re: getting started with encryption "J.O. Aho" <user@example.net> - 2014-10-12 17:45 +0200
                Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-13 08:58 -0400
                Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-13 09:23 -0400
                Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-13 10:44 -0400
                Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-13 12:20 -0400
                Re: getting started with encryption "J.O. Aho" <user@example.net> - 2014-10-15 21:52 +0200
                Re: getting started with encryption gordonb.1o7q6@burditt.org (Gordon Burditt) - 2014-10-16 12:13 -0500
                Re: getting started with encryption Matthew Carter <m@ahungry.com> - 2014-10-16 15:25 -0400
                Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-18 08:13 -0400
                Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-18 07:52 -0400
                Re: getting started with encryption "J.O. Aho" <user@example.net> - 2014-10-18 14:46 +0200
                Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-19 07:47 -0400
  Re: getting started with encryption Denis McMahon <denismfmcmahon@gmail.com> - 2014-10-12 17:30 +0000
    Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-13 08:59 -0400

csiph-web