是否可以使用多个私钥进行加密（PHP）？
或者：如何为一群用户存储加密数据？
我承认，这是一个愚蠢的问题，正如该术语已经暗示的那样，私钥仅限于一个人。但我有以下场景：
用户 Tom 输入需要加密存储在数据库中的数据。用户决定将这些信息提供给吉姆和鲍勃。用户 John 和 Jayne 肯定无法解密它。当然，也不适合侵入服务器并有权访问加密数据和执行加密/解密脚本的用户蒂姆。
我认为 PHP openssl_public_encrypt 函数的公钥/私钥方法在这里不起作用，因为两个用户需要拥有“私钥”才能解密数据。
我想这是一个相当普遍的问题，但如果它很重要，它必须在 PHP 中完成（也许还有 MySQL）。
Or: How to store encrypted data for a bunch of users?
I admit, it's a silly question, a private key is limited to only one person as the term already implies. But I have the following scenario:
User Tom enters data that needs to be stored encrypted in a database. The user decides he wants to make this information available to Jim and Bob. The users John and Jayne must not be able to decrypt it. Of course also not to user Tim who hacked the server and has access to the encrypted data and the scripts that do the encryption/decryption.
I think the public key/private key approach with PHPs openssl_public_encrypt function won't work here as two users need to have that "private" key to decrypt the data.
I guess this a rather general question, but if it's important, it must be done in PHP (and MySQL maybe).
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
这就是 OpenPGP（以及其他系统）中的做法：
- 您正在生成秘密对称密钥，用于加密数据本身；
- 然后，用 Tom 的密钥对这个对称密钥进行加密；
- 此外，对称密钥可以使用吉姆和鲍勃的公钥进行加密，允许他们解密密钥，然后解密数据
That's how it done in OpenPGP (and, other systems):
- you are generating secret symmetric key, which is used to encrypt the data itself;
- then, this symmetric key is encrypted with Tom's key;
- also, symmetric key can be encrypted with Jim's and Bob's public key, allowing them to decrypt the key and after that to decrypt the data
PHP 为此提供了一个函数 -
openssl_seal()。该函数采用一组公钥，并对数据进行加密，以便可以使用任何一个相应的私钥对其进行解密（使用openssl_open ())。PHP provides a function for this -
openssl_seal(). This function takes an array of public keys, and encrypts the data so that any one of the corresponding private keys can be used to decrypt it (usingopenssl_open()).我不知道 PHP 中的库。但一般来说，过程如下：
查找“PHP”时应该有一些结果和 PKCS7"...
I don't know libraries in PHP. But in general the procedure is as follows:
There should be some results when looking up "PHP and PKCS7"...
使用与 Tom 的密钥不同的数据加密密钥（称为 Kgeneral）。
用 Tom 的公钥加密 Kgeneral，并将结果提供给 Tom - 他可以使用他的私钥解密并获得 Kgeneral。
如果另一个用户需要访问数据，Tom（或您的应用程序）可以使用他的公钥加密 Kgeneral，并以这种方式授予他访问权限。
Use a data encryption key (call it Kgeneral) that's distinct from Tom's key.
Encrypt Kgeneral with Tom's public key and give the result to Tom - he can use his private key to decrypt it and obtain Kgeneral.
If another user then needs access to the data, Tom (or your application) can then encrypt Kgeneral with his public key, and give him access that way.