key based on password

[robstoll]

Hi,

I have the following scenario:

• data is saved encrypted in DB
• key for encryption must not be saved directly on the system (in clear text)
• yet, application needs the key to decrypt the data
• hence key shall be saved encrypted based on the users password

therefore I would like to know, how can I generate a key passed on a users password?

Cheers,
Robert

[sarciszewski]

hash_pbkdf2().

[robstoll]

thank you, and is it possible to use the generated key (with hash_pdkdf2) in Crypto::encrypt() somehow?

[sarciszewski]

$key = hash_pbkdf2(
    'sha256',
    $YOUR_USERS_PASSWORD_HERE,
    $A_HARD_CODED_PASSWORD_SALT_MADE_OF_16_OR_MORE_RANDOM_BYTES_UNIQUE_PER_USER,
    100000, // minimum 86000
    16,
    true
);

$cipher = Crypto::encrypt($message, $key);
$plain = Crypto::decrypt($cipher, $key);

var_dump($message === $cipher); // bool(true)

[sarciszewski]

Also, you want to use a CSPRNG for the salt. Crypto::createNewRandomKey() returns 16 bytes. That should be acceptable. Store that long-term per user.

[robstoll]

Thanks for the quick reply. I should have mentioned that I am using version 2.x of your library. Crypto::encrypt incorporates the following check:

if (!is_a($key, "\Defuse\Crypto\Key")) {
            throw new Ex\CannotPerformOperationException(
                "The given key is not a valid Key object."
            );
        }

Hence I need to transform the key generated by hash_pbkdf2 into a \Defuse\Crypto\Key somehow.
Any idea?

[sstok]

Use Key::saveToAsciiSafeString to convert to the Key object to a string for storing, then use Key::LoadFromAsciiSafeString to convert the stored string back to a Key object.

[robstoll]

@sstok I saw this functionality but it does not help me since I generate the key with hash_pbkdf2 which returns a string (or raw binary data).

[robstoll]

For now I am using the method I added in pull request #163
Please let me know if there is a better way to do this without breaking backward compatibility

[pnowosie]

What you need is a long planed feature #5, not implemented yet in v2.0. Maybe your PR will push things forward a little.

[SkynetHome]

I am looking to use this library in a project I am working on but am stuck on the proper storage and usage of keys as well. I have scripts receiving strings of data from users on Android and iOS and I need to encrypt that data and store it in mysql. The data submitted by one user needs to be available to certain other users so I don't think encrypting with a users password will work. Most importantly the data needs to be absolutely secure and absolutely unreadable by me the only DBA. What would be the best approach for storing a key so that PHP can encrypt and decrypt POST and GET requests as needed without giving me any possible access to the data stored on my server.

[defuse]

Revisit this when rewriting documentation #52