search

garasijogi / Siakmas

Accounting web app with codeigniter.
4 stars 8 forks source link

Encrypting MariaDB #15

Open Androx27 opened 5 years ago

Androx27 commented 5 years ago

Steps taken:

  1. Creating key for encrypting and decrypting db
  2. Encrypting key with another encryption + salt method so MariaDB can decrpyt/encrypt securely

Things to do:

  1. Since latest XAMPP is using MariaDB 10.1.38 (the latest ver. ones is 10.3.14) and lacks plugin for that encryption work, i'll try to using this version 1st before MIGRATING to the latest ver.
  2. Testing.
ryumada commented 5 years ago

hey I still don't know about it, but do MariaDB can be used on a native-browser-app or php docker or something like that that make this web app standalone?

Androx27 commented 5 years ago

hey I still don't know about it, but do MariaDB can be used on a native-browser-app or php docker or something like that that make this web app standalone?

[https://mariadb.com/kb/en/library/installing-and-using-mariadb-via-docker/]

Androx27 commented 5 years ago

Testing with done MariaDB 10.1.38

Results

Things to do:

  1. Making auto script to change the rotation of keys each specific time
  2. Changing CBC to CTR (will try if CTR is supported) ❌

VULN FOR NOW

  1. Since CBC is used, the table column name is still in plain text

DONT ASK THIS (IF YOURE ASKING THIS, THEN YOU'RE AN IDIOT)

Can you encrypt the db name too?

Ref:

db encryption encrypted table but not column name