samedi 3 janvier 2015

Software to use for encrypting data in PHP



I'm interested in programming and information security, I would like to combine both my interests to build sort of password manager.


This would be how the user would interact with the site:




  1. Alice creates an account and login, Bob does the same.




  2. Alice creates a password in her vault that only she has access to. This password encrypted with Alice’s public key using her account password.




  3. Bob creates a group and invites Alice. Private and public keys are generated for this group. The passphrase (random generated) is encrypted with each member’s public key.




  4. Alice decides she want to share her password with Bob. Her password is decrypted using her private key with her account password as the passphrase, the password is then encrypted the Bob’s public key and inserted to his keyring.




The main objective is to protect each password and make sure only selectable users have access to the password. If someone malicious would gain access to the server and database they would have access to all keys and encrypted passwords, but as long as the user has chosen a strong passphrase, the keys and encrypted passwords would be safe. Is this a correct assessment?


I'm going to build this with PHP but I'm unsure which libraries I should use for encryption. Should I use gpg directly and run commands on the server or should I use a proven PGP library for PHP?


Any pointers would be helpful.





Aucun commentaire:

Enregistrer un commentaire