On Wed, Jun 23, 2010 at 12:21 AM, Peter Lind <peter.e.lind@xxxxxxxxx> wrote: > I haven't had to implement a scheme like this but for an app I'm > working on we've been considering the same issues in order to keep > member data safe. I would say your best bet is to keep the decryption > key in memory while the app is running. Initialize it by hand whenever > the server is started - don't store it on the disk. Yes, your server > won't be able to start up the app on it's own but that's the security > in the design, not a flaw. If you want automatic access for the > web-app you've compromised security (anyone compromising the server > has automatic access as well). That's something I've thought about before. Storing MySQL on an encrypted partition using cryptoloop or something. However, every time the server boots - someone has to manually unlock the partition (unless some sort of physical key is present, then another dimension is introduced) However, that would solve the data being encrypted at rest, more or less. The issue of how to use the data in the web application is still not addressed this way :( -- PHP General Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php
