4

I am using Apache, MySQL and PHP via HTTPS.

I need to be able to store sensitive information so it can be shared among several people. If I have a database (secret) and two php files: (/var/www is my web root)

/var/inc.php
/var/www/secret.php

In /var/inc.php, among other things, I have a variable named $enckey, which is a 32 character alphanumeric string. Its permissions are set to be read only.

In secret.php I have a username, password and key field. They key field ($key) is a string know by all users (each person has the same key since I'm using that as part of the salt), it would be a 8-12 alphanumeric with special characters string.

Everyone has their own username and password that are MySQL users/passwords as well. When they log in their user credentials would be validated with MySQL first. There are no database usernames or passwords in /var/inc.php.

My secret database has a table, secret like this:

CREATE TABLE `secret` (
    `id` int(11) unsigned NOT NULL AUTO_INCREMENT,
    `name` varchar(64) DEFAULT NULL,
    `data` text,
    PRIMARY KEY (`id`)
) ENGINE=InnoDB DEFAULT CHARSET=latin1;

If I store information in a MySQL table using:

AES_ENCRYPT('secret data', $enckey . $key)

and extract the data out using 

AES_DECRYPT(`secret`.`data`, $enckey . $key)

am I doing enough to keep the data stored in the MySQL data column safe? Is there something more/different I should be doing?

UPDATE: Any one given access to the site (anyone with a valid user name/password) would have access to all sensitive data. The goal is to prevent a third party from getting the data if they were able to get to the database somehow.

4

1 回答 1

0

AES-128 加密的蛮力攻击是可以实现的，特别是考虑到显卡的计算能力或正在为比特币挖矿开发的一些基于 ASIC 的系统，但对于你得到的东西来说仍然很昂贵。您可以通过更改密钥（可能贵数百倍）或使用 AES-256（贵 2^128 倍！）来使您的加密更加昂贵。

更便宜且更有可能的攻击是有人试图窃取您的密钥。您的场景假设攻击者以某种方式进入了您的数据库。尝试想象攻击者实现该目标时的有利位置。从那个有利的角度来看，密钥的保护程度如何？

一些例子：

  • 该数据库是从备份磁带或驱动器中获取的。您是否将密钥备份到同一磁带或驱动器？
  • 攻击者以某种方式获得了对您的数据库服务器的 root 访问权限。该服务器是否与您拥有密钥的应用服务器分开？是否有任何 SSH 证书允许从您的数据库服务器访问应用程序服务器？您的网络是否阻止从您的数据库服务器直接访问您的应用程序服务器？
  • 攻击者可以访问您的源代码控制管理系统。是否有任何密码（例如 /var/www/secret.php 中的密码）通过您的应用程序签入源代码控制？
  • 您的管理员可能会被胁迫、欺骗或贿赂以提供密钥。您是否以一种易于检测且难以掩盖的方式记录活动？在可行的情况下，您是否可以划分职责，以便给定管理员可以访问数据或密钥，但不能同时访问两者？
  • 如果其中一个有权访问该应用程序的人的笔记本电脑被盗，拥有该笔记本电脑的攻击者是否能够不受挑战地访问数据库？
  • 密码文件据说是只读的。运行应用程序的帐户是否是只读的，除了 root 以外的任何人都无法读取？是否有其他应用程序共享该帐户？您是否阻止使用同一帐户对服务器进行 SSH 访问？该帐户的凭据是否安全？
于 2013-04-21T17:50:47.740 回答