How to implement two-way encryption using PHP or mySQL?

I am trying to securely store OAuth tokens and keys, and I know that it is best to encrypt them and treat them as user passwords. How can I do this, while still being able to decrypt them and use them to call an API, say twitter (I just hash my passwords that won't work for OAuth keys, since hashing is one way)?

I am open to this either in mySQL or in PHP, so I would appreciate examples in any case or for the pros / cons of each approach.

+4
source share
1 answer

You can use the mcrypt library in PHP ( http://php.net/manual/en/book.mcrypt.php ), it supports all the basic cryptographic algorithms. I suggest you use AES-128, it is a kind of industry standard. Just make sure you keep the key in a safe place. Then you can encrypt your data, convert it to base64 and save it in your database. Whenever you need to use data, just retrieve it from the database and apply the inverse operations.

I am not familiar with how MySQL works exactly. Maybe it is possible to store data in encrypted form and whether to keep your key somewhere safe?

From a security point of view, the PHP method will be better because the data coming from your database and coming from your database is still encrypted.

Please do not use XOR cypher, at best it is funny. The only leaked pair of open ciphertext will show your full key ( plaintext XOR ciphertext = key ). This provides perfect protection when used as a disposable panel . Of course, you cannot use this, because now you need to use a different key for each piece of data and , in some way, to safely store all of these disposable pads. Maybe you can use encryption for this;) ...? (insert an infinite loop here).

+3
source

Source: https://habr.com/ru/post/1347153/


All Articles