views:

63

answers:

1

I have a concatenated string and I want to pass it as query string. For security, I want to encrypt the concatenated string using gpg private key that resides in the same folder where this .php file resides on the remote server.

I want to know whether it is safe to keep the public and private keys on the remote server and use it for encryption and decryption.

+1  A: 

First question: Why? - If you're transferring data on the same server use PHP sessions or store it in a database. IF you want to transport data from one server to another server use another communication channel between these too, like a HTTP request POSTing the data.

IF you still want to do it: I won't use GPG for this as this produces quite some CPU load and increases the size of the message dramatically, assuminf your data is relatively short. It's better to use blowfisch or similar algorithms, see PHP's crypt function for instance.

About the security: It is more or less as secure as the whole server is but you should make sure your private key is hidden outside the document root of the web server. And read rights should be limited to the web server user ...

johannes
Can it be done using conventional encryption? Is it secure to store unencrypted string in session?
RPK
What is conventional encryption?Storing data in the session is - again - as secure as your web server. If it's hosted by a hosting company they might have access to the session - but they also have access to the key then. If your server is in your data center, protected by physical locks and running fully patched software it's fairly secure.
johannes
Some column values contain long text that was typed in the Text Area control. How much data the session can hold?
RPK