2
$\begingroup$

Sorry if this doesn't fit the guidelines, but I believe it is a conceptual issue that is not opinion-based and can be reasonably answered in a single authoritative answer (I'm also struggling to find anywhere else to ask this!).

I'm creating a system that needs to send data securely between a public website and a database, and store some of that data securely in the database. The system will use PHP (either 5.6 or 7.2) and I plan to use Sodium for the encryption (either included in 7.2 or manually included with 5.6). I plan to use libsodium.js on the website side. I'm fairly new to encryption, but I would like to check that the process I am designing - rather than the actual code at this stage - will allow for the system to be theoretically secure.

Process

  1. Customers will set up an account on the website and log in to use the service.
  2. The server will create a public/private key pair for each user on registration (stored in a file outside of the root directory). These will change very infrequently (and only via a controlled process to ensure data is still decryptable, if necessary).
  3. When a customer logs in, their "server" public key will be stored in their session, and libsodium.js will be used to create a public/private key pair on the website side (a new pair will be generated each time someone logs in).
  4. The "website" public key will be sent to the server via Ajax and stored in the session.
  5. Any data that is entered into the site will be collected via a jQuery/JavaScript process, encrypted using the website private key and the server public key via libsodium.js crypto_box and submitted to the server via Ajax as an encrypted string along with the nonce (this may require a hybrid approach of symmetric and asymmetric encryption for long messages).
  6. The server will receive the data, decrypt it, and then process the individual fields.
  7. Fields that need to be searchable/joinable in the database will be stored in an unencrypted way. Other fields will be encrypted using the server private key and a nonce, using crypto_secretbox. The data and the nonce will then be stored in the database.
  8. When encrypted data needs to be retrieved from the database, it will be decrypted using crypto_secretbox and then rencrypted using the server private key and website public key, before being made available to the website, where it can be decrypted using libsodium.js.

Actual coding aside, have I missed anything or got anything wrong with this proposed process?

$\endgroup$
  • $\begingroup$ First thing you missed to explain: Why? What exactly are you hoping to protect against? (And why the usual well-researched solutions, that probably protect you against more things than you even can name, are not good enough?) $\endgroup$ – deviantfan May 23 '18 at 5:55
  • $\begingroup$ Thanks for the comment :) The why is because the data is very sensitive and we need to protect wherever possible. I'm not 100% sure what you mean by "usual well-researched solutions" but it needs to be a custom solution for a number of reasons, so the idea is to use the features available in Sodium, which PHP have decided to integrate in 7.2 $\endgroup$ – thebronsonite May 23 '18 at 12:37
  • $\begingroup$ Could you tell us these reasons, to know what possibilites are not usable? $\endgroup$ – deviantfan May 23 '18 at 15:52
  • $\begingroup$ The main reason is that it isn't a brand new system. It will be a component of something a lot larger where there is no solution on the market that will perform some of those tasks and the client wants to carry on using the same system without overhauling their entire IT software or adding another system into the mix. Could you perhaps list some of the well-researched solutions you're referencing? $\endgroup$ – thebronsonite May 23 '18 at 16:30
  • $\begingroup$ There are a number of reasons that we or any other developer who uses StackExchange may want to develop a secure process like this. Hopefully, if this post can determine a process that is theoretically secure, it will assist me and perhaps other developers in the future. $\endgroup$ – thebronsonite May 23 '18 at 16:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.