Encrypted session handler

15 Comments

[UPDATE]  Enrico Zimuel has a better version of this[/UPDATE]

A little while ago I had come upon the problem of having to store sensitive data in a user session.  The solution that I (and several others came upon) was creating a mechanism for storing encrypted data in a session.  But what we wanted to do was build something that didn’t have a single point of failure.  We also wanted to build something portable.  What we built was a simple Zend Framework session handler for storing sensitive data.

 

 

 

What this does is allow you to transparently store encrypted data in a session.  Because it’s encrypted, someone hacking in to the server, say via an include vulnerability, would be able to read the session data, but not decrypt it.  That’s because the initialization vector is stored in a cookie on the browser.  So in order to decrypt the session an attacker would need to do both an XSS and a remote code injection attack.

15 thoughts on “Encrypted session handler

  1. You do realize that you are storing everything needed to decrypt in SESSION as well right? cookie is just the hex version of the iv binary. Shouldn’t you only be storing the iv on the client?

    Cookie:
    string ’29a498dd9057b334′ (length=16)

    Session:
    array
    ‘secretKey’ = string ‘325951551157010490207714’ (length=24)
    ‘iv’ = string ‘)��ݐW�4’ (length=8)

  2. It is a really good idea though! I am going to hack your good version so that encryption is transparent via __get and __set. I’ll post it somewhere when done.

  3. Here, now it should work just like the normal session class; encrypting and decrypting transparently while maintaining backwards compatibility

    [code]
    private function _encrypt($value)
    {
    return bin2hex(
    mcrypt_encrypt(
    self::CIPHER,
    $this-secretKey,
    $value,
    self::MODE,
    $this-_iv
    )
    );
    }

    private function _decrypt($key)
    {
    if ($var) {
    $decrypt = mcrypt_decrypt(
    self::CIPHER,
    $this-secretKey,
    pack(
    ‘H*’,
    $var
    ),
    self::MODE,
    $this-_iv
    );
    $var = rtrim($decrypt, “”); // remove null characters off of the end
    }

    return $var;
    }

    public function setEncrypted($key, $value)
    {
    $this-$key = $this-_encrypt($value);
    }

    public function getEncrypted($key)
    {
    if (isset($this-$key)) {
    return $this-_decrypt($this-$key);
    }

    return null;
    }

    public function __set($key, $value)
    {
    parent::__set($key, $this-_encrypt($value));
    }

    public function & __get($key)
    {
    return $this-_decrypt(parent::__get($key));
    }
    [/code]

  4. I got

    Fatal error: Uncaught exception ‘Zend_Session_Exception’ with message ‘Invalid Session Data’ in C:workspaceJoomlatest.php:53 Stack trace: #0 C:workspaceJoomlatest.php(92): EncryptedSession-__construct() #1 {main} thrown in C:workspaceJoomlatest.php on line 53

    which is what I was expecting. What were you expecting?

Leave a Reply

Your email address will not be published. Required fields are marked *