-3

Needed to store passwords in mysql from other services. Hash not work, i needed to decryt passwords. How to safety to do that? Only that i think safe way is to use hardware token with decrypt key? Is there any other issues? Sorry my bad English.

user2557769
  • 11
  • 3
  • 1
    If you think you need to decrypt passwords, you're probably wrong. – neminem Apr 02 '15 at 17:01
  • You can't and you shouldn't , because password must be secrect and the way that you do it is with MD5 Hash, if you are trying to make a login you should hash the input of the users and compare by the hashed password on the database. – xsami Apr 02 '15 at 17:07
  • Typically you don't want to allow them to be able to be decrypted. If you can decrypt them, then someone else can as well and that's where the issue is. – Kalel Wade Apr 02 '15 at 17:08
  • 1
    Are these user passwords, or service passwords for your app (e.g. database, API, etc)? – halfer Apr 02 '15 at 17:11
  • @xsami: MD5 is regarded as essentially broken these days - don't use it for user passwords! Use Bcrypt or other slow algorithm instead. – halfer Apr 02 '15 at 17:12
  • 1
    No, not in my app autorization, i know that store password not hash is wrong way, but i need to do authorization on other sites-services by login/password from users, no other way, than decrypting password. – user2557769 Apr 02 '15 at 17:24

1 Answers1

1

You ask how to safely to store encrypted data in MySQL in a way in which it can be decrypted automatically.

Here's the thing: encrypting and decrypting itself is easy. Php offers the mcrypt package. http://php.net/manual/en/mcrypt.examples.php

The safety of such a procedure depends, however, on secure key management. If the app you use with MySQL is capable of decrypting the data, and the key is available to it, then a cybercriminal who penetrates your system will have access to it. Cybercriminals can read your php code, see how you decrypt this data, and do it themselves. So the safety of this process depends on how hard it is for your opponents to obtain your keys.

I suppose you could create a web service that accepted encrypted data and returned decrypted data. That web service could hold the keys inside it. You could protect it in a few ways:

  1. putting it behind a firewall
  2. rate-limit it to a few dozen decryption operations per second
  3. keep the decryption keys inside it.
  4. log all operations (but not the decrypted data) and monitor the logs diligently.

Another possibility is to do something client side. The open-source password safe called Keepass http://keepass.info/ is a good example, and so is Bruce Schneier's password manager. https://www.schneier.com/blog/archives/2014/09/security_of_pas.html

One-way password hashing (http://php.net/manual/en/book.password.php) prevents decryption, but still allows password verification. It's much harder to steal passwords that are one-way hashed.

With respect, this is not a suitable project for an inexperienced person if the passwords protect valuable assets. Cybercriminals are way ahead of the rest of us.

O. Jones
  • 103,626
  • 17
  • 118
  • 172
  • Thanks for professional answer, i also think in that way, but i think to use some hardware usb token, if this possible. – user2557769 Apr 02 '15 at 17:59