Need to encrypt an entire Table using SHA512 from an External form in Concrete5

Viewed 519

I have a complex form that is posting the data to 2 different tables in a MySQL Database. That part is working fine. However, I need to store the information being encrypted with a Specific key so that when my API sends the data to another Server it can be decrypted on the other end. SHA512 was recommended to me but I'm not sure.

I have SQL/MySQL experience but have never dealt with Encryption before.

I am using PHP 7.1 / mysqli

Thanks!

1 Answers

However, I need to store the information being encrypted with a Specific key so that when my API sends the data to another Server it can be decrypted on the other end.

This sounds roughly like the sort of problem CipherSweet was meant to address.

CipherSweet solves the "searchable encryption" problem for PHP and Node.js software.

Adapted from the CipherSweet EncryptedRow documentation:

<?php
use ParagonIE\CipherSweet\BlindIndex;
use ParagonIE\CipherSweet\CipherSweet;
use ParagonIE\CipherSweet\EncryptedRow;
use ParagonIE\CipherSweet\KeyProvider\StringProvider;

// Configuration (with a random hex-encoded example key):
$keyProvider = new StringProvider('4e1c44f87b4cdf21808762970b356891db180a9dd9850e7baf2a79ff3ab8a2fc');
$engine = new CipherSweet($keyProvider);

// Define your row structure
$processor = (new EncryptedRow($engine, 'my_table_name'))
   ->addTextField('my_column_name')
   ->addTextField('other_column_name')
   ->addBooleanField('secret_boolean')
   ->addIntField('secret_integer')
   ->addFloatField('secret_decimal_value');

Once you have your processor set up, you can also add blind indexes to each field in the encrypted row (or "compound blind indexes" which consist of multiple plaintext fields).

$processor->addBlindIndex(
    'my_column_name', // column
    new BlindIndex(
        'my_column_name_index', // index name (used in key derivation)
        [], // Empty array: No transformations,
        8, // Index size (bits); use the planner to get recommended sizes
    )
);

Be careful with blind indexing!

Blind indexes give you a lot of power and flexibility (i.e. not only can you encrypt your database records, but you can still construct performant SELECT queries by using blind indexes in the WHERE clause), but you can introduce data leaks if you deviate from the recommendations provided by the planner.

But if you use it as directed, you can make strong arguments for the security of your database that will stand up to scrutiny from third party security assessors (which you should absolutely hire, regardless of whether or not you go with CipherSweet).

Once your processor is configured (with or without blind indexes), you can encrypt/decrypt rows like so:

// Encrypting/decrypting an example row
$plaintext = [
    'unspecified' => 'not defined in the processor, will remain unencrypted',
    'my_column_name' => 'foo',
    'other_column_name' => 'bar',
    'secret_boolean' => false,
    'secret_integer' => 123456,
    'secret_decimal_value' => 3.14
];
[$encryptedRow, $indexes] = $processor->prepareRowForStorage($plaintext);
// Now use $encryptedRow and $indexes in your database queries

// To decrypt, you only need the first item ($encryptedRow)
$decrypted = $processor->decryptRow($encryptedRow);

If you're looking for a secure, easy-to-use solution, CipherSweet gets you most of the way there, but isn't 100% what you're looking for. There's still a bit of application-specific usability logic that needs to be bolted on top of it.

If you need that elusive 100% turn-key easy-to-use solution, ask a security company to build it for you. Paragon Initiative Enterprises (which developed and maintains CipherSweet) offers such services. (Disclaimer: I work for PIE.)

SHA512 was recommended to me but I'm not sure.

As others have stated, SHA512 is a hash function, not a cipher. The difference is important.

Related