where to store an encryption key?

[Newsgroup_User]

i am trying to set up an application that is reasonably secure....

trying to protect the most sensitive data (cc info) in case ftp access
is gained to the site...

i am now encrypting data using encrypt when saving to the db

but the key is either in the .cfm page or if it were in the db, a
reference to its location in a query. either way, if one read the
sourcecode one could gain the key.

is there a way to make the key known only to the db? never have the key,
or a reference to it on a cfm page?

the other way i was thinking was if there was a cfinclude tat referenced
a file that was accessable to the page, but not accessable to ftp. that
way if one had ftp access they still couldnt see the key or reference to
it in the db. only a ref to the include.....

it gets complicated quickly. any help or if you could point me in the
right direction much appreciated.

[Kevin_Schmidt]

You could store the encryption key in a file that is not accessible to the web server and then read it in using <cffile>.

You could then load it into the application scope and use it that way. It wouldn't be in the database and it wouldn't be in a file accessible via FTP, assuming you set up the proper permissions.

[Newsgroup_User]

thanks, thats what i've pretty much decided to do.

Kevin Schmidt wrote:
> You could store the encryption key in a file that is not accessible to the web
> server and then read it in using <cffile>.
>
> You could then load it into the application scope and use it that way. It
> wouldn't be in the database and it wouldn't be in a file accessible via FTP,
> assuming you set up the proper permissions.
>

[Newsgroup_User]

Kevin Schmidt wrote:
> You could store the encryption key in a file that is not accessible to the web
> server and then read it in using <cffile>.
>
> You could then load it into the application scope and use it that way. It
> wouldn't be in the database and it wouldn't be in a file accessible via FTP,
> assuming you set up the proper permissions.
>


mmmm where would the cffile tag go? it would have to be someweher on a
page withing the site. again, a reference to where the key is. if
someone got ftp access, and found the page with the reference, they
could just make a page that would output that application variable and
then they would have the key.

the key, or any reference to where it is located cannot be on any page
accessible via ftp.

but the variable itself needs to be available to the web app.

is there any way to load a variable into a session scope before anything
else happens? like specify it in cfadmin or something...