我应该在哪里存储 php 的加密密钥？
我正在编写一个接受敏感客户数据的 PHP 应用程序，因此我需要在将其存储到 mysql 数据库之前对其进行加密。我将使用 mysql 的内置 AES 功能来进行列级加密。
我想避免将加密密钥存储在服务器上，因此我将提供一个网页供管理员登录并输入加密密钥。我想在应用程序运行时将此密钥存储在内存中，但永远不要永久存储到磁盘中。
最好的方法是什么？
我可以修改 $_SERVER 数组来存储请求之间的信息吗？我可以用 apache 以某种方式存储密钥吗？也许共享内存？
I'm writing a php application that accepts sensitive customer data, and so I need to encrypt it before storing it in a mysql database. I'm going to use mysql's built-in AES functionality to do column-level encryption.
I want to avoid storing the encryption key on the server, and so i'm going to provide a web-page for an administrator to log-in, and enter the encryption key. I want to store this key in memory while the application is running, but never permanently to disk.
What is the best way to do this?
Can I modify the $_SERVER array to store information between requests? Can I store the key with apache in some way? Maybe shared memory?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
为什么不使用 PHP 的本机 openssl 加密方案（PECL 扩展），而不是依赖 MySQL AES 进行加密。这需要私钥和公钥，公开进行加密，私有进行解密，并且密钥可以保存在不同的地方。
Rather than rely on MySQL AES for encryption, why not use PHP's native openssl encryption scheme (a PECL extension). This requires a private and public key, public to encrypt, private to decrypt, and the keys can be kept in separate places.
我最终将加密密钥存储在内存表中。所有对数据库的访问都是通过一组存储过程完成的；存储过程包括进行密钥管理（即将密钥插入内存表、更改密钥、检查密钥是否已输入等）以及存储/检索应用程序数据的能力。
通过这种设计，留在应用服务器上的数据库凭证仅具有通过一组定义的过程进行查询的授权，而无法直接读取加密密钥。
我喜欢这种方法，因为：
I ended up storing the encryption key in an in-memory table. All access to the database is done through a set of stored procedures; The stored procedures include the ability to do key management (i.e. insert key to memory-table, change keys, check if a key has been entered etc.), as well as store/retrieve application data.
With this design, the database credentials left on the application server only have the authorization to query through the set of defined procedures, and have no way to read the encryption key directly.
I liked this approach because:
一种可能性是创建 RAM 磁盘并将密钥存储在其中。
One possibility is to create a RAM disk and store the key there.
存储任何类型的加密密钥的最安全位置是在服务器上而不是在数据库中，并确保它由 root 拥有并且其他人无法读取。
The safest place to store any kind of encryption key is on the server NOT in the database, and make sure it is owned by root and not readable by others.
编写一个 php 配置文件并将其存储在您的主目录中。只允许 php 访问它。
包含在每个使用主文件夹绝对路径的加密密钥的 php 页面的顶部。最终用户无法访问此文件夹。
Write a php config file and store it in your home directory. Allow only php to have access to it.
Include at the top of every php page that uses the encryption key using an absolute path to the home folder. This folder is not accessible to the end user.