Storing Passwords in reversible form

Asked 2008-11-04T02:44:55.070

I have a PHP app that needs to run bash scripts, and provide a username & password (for remote systems). I need to store these credentials somewhere that is accessible by my PHP (web) app. The logical place is the database (currently MySQL, but will be agnostic). The problem with the "standard" way of hashing and storing the credentials, is that it is not reversible. I have to be able to get the credentials out as unencrypted clear text, to be able to insert the data into bash scripts.

Does anyone have any suggestions for a secure way to go about this ?

I thought maybe PKI'ing the credentials, and storing the result in the DB. Then use the private key to unencrypt (PHP can do that). Store the scripts to do this outside the web root.

Any thoughts much appreciated.

php passwords storage

Edit Report

2 Answers

It looks like you pretty much have two methods of doing this:

1) Like you suggested use an encryption algorithm or algorithms which can then be decrypted and used for authentication in your scripts. You can use the MCrypt library in PHP to accomplish this.

2) Depending on the required level of security and your script's level of vulnerability, you could use a secure hash, key, or some other hard to guess unique identifier that you can use to hijack each user's account within the confines of the script.

answered 2008-11-04T02:56:44.423

Just to follow up on the suggestion to use MySQL encode and decode functions, the manual is vague on just how these work:

The strength of the encryption is based on how good the random generator is. It should suffice for short strings.

But what I'd suggest is that you can instead use the built-in MySQL 5.0 AES functions; AES_ENCRYPT() and AES_DECRYPT()

SELECT AES_ENCRYPT('secret squirrel', '12345678') AS encoded

=> ØA;J×ÍfOU»] É8

SELECT AES_DECRYPT('ØA;J×ÍfOU»] É8', '12345678') AS decoded

=> secret squirrel

These use 128-bit AES which should be strong enough for most purposes. As others commented, using a salt value and a key with a high entropy is a good practice.

answered 2008-11-24T00:46:19.647

Storing Passwords in reversible form

2 Answers

Your Answer