In my database I store information which is encrypted and decrypted on the fly via a PHP-class.
Per application I use a private key appended with a user key to make sure the decryption only succeeds when a user tries to decrypt its own data.
The user 'key' is stored in the database; but the private key (application level) is stored as txt-file in the FS. Off course 'above' the web-root.
Considerations:
- If the database gets hacked: they end up with one part of the key, and encrypted data
- If PHP-stops or is corrupt: they end up with a single page with only include('../private/private.php') in it.
- If NGINX fails: the connection is 'just' dropped.
The only scenario I can think of is the corruption of the system itself. But the server runs a firewall, is updated regularly, runs fail2ban and only the services needed are run. SSH logins only via key-access etc etc
I was wondering if this is the 'best' practice. Or if there is a better way to do this kind of encryption with above specifications? What would be the correct access-rights to the key-file?
At the moment the database and webserver are both on the same server facing the internet. Is it better to split them and create an internet facing server with only the webserver; and put the database server and key-file on a different server in a private network?
edit: the private key to encrypt the data is build up by two components:
$key = $app_key . $user_key