How to save openssl_public_encrypt () output in MySQL database?

Question

I need to store an encrypted, but recoverable (by administrator) password in MySQL, from PHP. AFAIK, the easiest way to do this is with openssl_public_encrypt (), but I'm not sure what type of column is needed. Can I judge the maximum length of encrypted output based on key size and input?

Or am I forced to use a huge field (like BLOB) and just hope it works all the time?

Answer 1

The openssl_public_encrypt function limits the size of the data that you can encrypt to the key length; if you use the add-on (recommended), you will lose an extra 11 bytes.

However, the PKCS # 1 standard, which uses OpenSSL, specifies a padding scheme (so that you can encrypt smaller quantities without losing security), and this padding scheme is at least 11 bytes (it will be larger if the value you encrypt is lower). Thus, because of this, the maximum number of bits that you can encrypt with a 1024-bit key is 936 bits (if you do not turn off padding by adding the OPENSSL_NO_PADDING flag, in this case you can go up to 1023-1024 bits). With a 2048-bit key, this is instead of 60 bits.

Of course, you should never disable padding, because it will make the same passwords for encryption with the same value.

So, for a 1024-bit key, the maximum input password length is 117 characters.
For a 2048-bit key, this is 245 characters.

I am not 100% sure of the output length, but a simple example should confirm this, the output is a simple function of the key length, so for a 2048-bit key, I suspect it is 256 bytes.

You must use the binary string with the required length to store the password.
For speed reasons, it is best to use a limited-length index in the field.
Do not use blob (!), Because it will slow down without any benefits.

 CREATE TABLE user id unsigned integer auto_increment primary key, username varchar(50) not null, passRSA binary(256), <<-- doublecheck the length. index ipass(passRSA(10)) <<-- only indexes the first 10 bytes for speed reasons. ) ENGINE = InnoDB 

Adding extra bytes to the index will simply slow down and expand the index file without any benefits.