Rails database - how to store encrypted data using the user's password?

Question

I have a database that will be holding sensitive data, so it should be encrypted in the database. Basically the sensitive data are credentials to another web site. So I want to encrypt them with the users password + salt.

To decrypt the credentials one would need the password.

I see two ways: On login, I could decrypt the credentials, and then store them in the session? Is that safe?

OR

Harder on the user would be to ask again for the password before decrypting the stored passwords/ids?

We don't want to have any ability to use the stored credentials ourselves.

Answer 1

I highly recommend "Security on Rails" for this. It's a tricky topic, so you'll need to spend some time reading up in order to get it right. They cover exactly this topic, including how to salt the encrypted data, unit test to make sure it is encrypted, and more.

Their sample code shows how to add class methods to ActiveRecord::Base so that you can make any database column encrypted in one line of code. Definitely an idiomatic Rails approach.

It's an awesome read - the unit tests blew me away, so seriously ... go get it.

By the way, when you said

We don't want to have any ability to use the stored credentials ourselves.

you realize that because your code receives the unencrypted data from the user's browser, you do have access to the data in memory before it is encrypted on disk, or when it is unencrypted when the user wants to use that data later. And bad people could get access to that data if they root your box, sneak something into a Ruby eval(), etc.

Encrypting the data does help a lot, though. SQL injection attacks can't get the decrypted data, for example.