Database encryption with user supplied pass-phrase

Question

Hello,

I'm going to build a small web application which stores some encrypted data in a database (sqlite). One requisite is not to keep the encryption key along with the database file , for obvious reasons.

So the approach could be an user supplied pass-phrase at the login screen and then derive a key from it to cipher the data. Of course the transport will be secured by SSL.

The question is, due to the expected behaviour for the user is to enter the pass-phrase just once (at the login, for example) and not being asked every time he clicks on a link, the pass-phrase has to be stored somewhere, at least temporarily... but, where?

It is a good idea to keep it in a PHP session variable? ...it will be written to disk on the server side.

Is it better (or worse) to keep it on the client side? discarding cookies, I don't know if it is even possible, maybe Ajax would help?

Anyway, which do you think is the best approach to this problem?

Thanks.

Answer 1

First, you should find a consistent algorithm to generate the key from password or passphrase. You can come up with your own but I would suggest you checkout following algorithms,

1. PBE (Password-based Encryption), like the one used in PKCS#7.
2. Kerberos string-to-key function.

You don't need to write code to do this. You can find implementations on these in most popular platforms, C/Java/C# etc.

Second, you need to have an authentication session. Otherwise, you have no way to know who is clicking on the link.

Then, you need to store the key with the login session data. This can be in a database, PHP session, or even in a cookie, if it's properly encrypted.

Answer 2

The algorithm you are looking for is called PBKDF2. It derives an encryption key from a password.

You might want to store the derived key in non-disk-backed ram e.g. memcached.