#Question on encrypting data

7 messages · Page 1 of 1 (latest)

half eagle
#

Not related to next, rather a feature I need in my app.

I building an app for a client, they have some very private/confidential data of their users, which they need encrypted before storing in the db, so only the an authorised user can see it and no one else. Need to know the right way to handle this,

  1. Since passwords are hashed I cannot use it as a encryption key since the password is only entered on the login event,
  2. I could technically store the plain password in the session, but seems very insecure, and a hack
  3. The app also has OAuth, which means I cannot rely on password as the encryption key (#2), because there wont be a password when a said user logins with google.

Need some assistance

little sedgeBOT
#
Post created!

🔎 This post has been indexed in our web forum and will be seen by search engines so other users can find it outside Discord

🕵️ Your user profile is private by default and won't be visible to users outside Discord, if you want to be visible in the web forum you can add the "Public Profile" role in id:customize

✅ You can mark a message as the answer for your post with Right click -> Apps -> Mark Solution
(if you don't see the option, try refreshing Discord with Ctrl + R)

heavy elk
#

I didn't see the bit about "only that user"

#

Password vaults often have this goal and mostly use Key Derivation Functions or KDFs to bulk up a password into an encryption key

#

https://en.wikipedia.org/wiki/Key_derivation_function

Key derivation function

In cryptography, a key derivation function (KDF) is a cryptographic algorithm that derives one or more secret keys from a secret value such as a master key, a password, or a passphrase using a pseudorandom function (which typically uses a cryptographic hash function or block cipher). KDFs can be used to stretch keys into longer keys or to obtain...

#

Basically you would have the client use the KDF to build the big stronk encryption key, encrypt their stuff and then send it to your back end.

#

To retreive it you would send back the encrypted stuff and they would again derive the key and decrypt their stuff.