[SOLVED] Encrypting a mysql table?

[heavyEddie]

I have a table that I'm thinking about putting some sensitive data in... any suggestions on how to encrypt the table so if I did get hacked I would still be somewhat protected?

[fenway]

Depends how secure you need, most solutions simply make it harder -- for "real" security, you need user input to "decrypt".

[heavyEddie]

I can't have the user decrypting it on their side... so I guess as secure as a guy can go without user intervention.

[bubblegum.anarchy]

Use DES_DECRYPT and DES_ENCRYPT - but this form of encryption is unlikely to stop a hacker.

[MadTechie]

if a hacker gets in, then (s)he will have access to the decryption method used (and password), i guess SSL would be a good idea,

one *idea* to protect the records of a client you could encrypt their data with their password and have their password stored using sha1 or md5 (chaning password would then need to decrypt and re-encrypt their encrypted data)

 

probably got some holes in that idea but still, its a thought

[bubblegum.anarchy]

probably got some holes in that idea but still, its a thought

Yeah - the salt would have to be the encrypted password which is stored in plain text for a hacker to use as a salt against the encrypted information, the only thing stopping a hacker would be the lack of knowledge that the information is salted with the encrypted password.

[heavyEddie]

Thanks for the information. 

 

I suppose this really isn't all that much different than all the config.php files that forums and such use.

[MadTechie]

probably got some holes in that idea but still, its a thought

Yeah - the salt would have to be the encrypted password which is stored in plain text for a hacker to use as a salt against the encrypted information, the only thing stopping a hacker would be the lack of knowledge that the information is salted with the encrypted password.

 

No the USERS password would be the password to the data related to that client, their be no point using something thats stored in the system!!

[bubblegum.anarchy]

Then one way encryption (md5/sha1) on the password would not be possible since decrypting would be required when applying the password as a salt to other information stored in a database.

[MadTechie]

Then one way encryption (md5/sha1) on the password would not be possible since decrypting would be required when applying the password as a salt to other information stored in a database.

 

you have totally missed the point.. it wouldn't affect the password stored at all!

 

have 2 salts and 1 hash..

when they login use

md5($_POST['pass']+salts1) = user login password

to decrypt data use

md5($_POST['pass']+salts2)  = data password (store in session)

i would use 2 salts to make it a little more secure

 

of course system data would require its own password and datamanagement would be a nightmare but as i said its an idea and changing the user password would mean your have to update all their info,

 

does that make sense ?

[igor berger]

You can wrtie your own MD5, that is custom make it.

This way no one will be able to enter!

 

The door to the safe is only good as the strength of the box!

[bubblegum.anarchy]

have 2 salts and 1 hash..

when they login use

md5($_POST['pass']+salts1) = user login password

to decrypt data use

md5($_POST['pass']+salts2)  = data password (store in session)

i would use 2 salts to make it a little more secure

 

does that make sense ?

 

No... but then again I do not really need to understand.

 

What I initially understood was that the encrypted password would be used as the key string in des_encrypt thusly:

 

SELECT @key_string := md5('secure_password');

UPDATE the_table SET the_field = des_encrypt('Some sensitive information stored in the database', @key_string);

SELECT des_decrypt(the_field, @key_string) FROM the_table

[MadTechie]

no the users password would be the key, so each of the "clients details" would be protected by their own password (while secure a nightmare to manage)

 

(infact the key is the resulting hash from the 2nd salt and the users password)

 

i would also point out this itsn't something i would recommand doing but more or idea to maybe spark others

[igor berger]

This is good encrypting all the records in a data base.

 

So if anyone breaks in to your database, they will just see Salt!

 

But when you transporting the data over the internet it will be decrypted on the server before transport!

 

So maybe if you do not trust SSL or want additional level of encryption use JavaScript encryption...

extra salt - client side.

[heavyEddie]

Thanks guys...  I apologize, I thought I responded but did not

 

I ended up salting against a file located below the public_html.  Not the best solution, but seems to be working fine.