3 Replies Latest reply on Oct 6, 2006 12:01 PM by Newsgroup_User

    where to store an encryption key?

    Level 7
      i am trying to set up an application that is reasonably secure....

      trying to protect the most sensitive data (cc info) in case ftp access
      is gained to the site...

      i am now encrypting data using encrypt when saving to the db

      but the key is either in the .cfm page or if it were in the db, a
      reference to its location in a query. either way, if one read the
      sourcecode one could gain the key.

      is there a way to make the key known only to the db? never have the key,
      or a reference to it on a cfm page?

      the other way i was thinking was if there was a cfinclude tat referenced
      a file that was accessable to the page, but not accessable to ftp. that
      way if one had ftp access they still couldnt see the key or reference to
      it in the db. only a ref to the include.....

      it gets complicated quickly. any help or if you could point me in the
      right direction much appreciated.
        • 1. Re: where to store an encryption key?
          Kevin Schmidt Level 1
          You could store the encryption key in a file that is not accessible to the web server and then read it in using <cffile>.

          You could then load it into the application scope and use it that way. It wouldn't be in the database and it wouldn't be in a file accessible via FTP, assuming you set up the proper permissions.
          • 2. Re: where to store an encryption key?
            Level 7
            thanks, thats what i've pretty much decided to do.

            Kevin Schmidt wrote:
            > You could store the encryption key in a file that is not accessible to the web
            > server and then read it in using <cffile>.
            >
            > You could then load it into the application scope and use it that way. It
            > wouldn't be in the database and it wouldn't be in a file accessible via FTP,
            > assuming you set up the proper permissions.
            >
            • 3. Re: where to store an encryption key?
              Level 7
              Kevin Schmidt wrote:
              > You could store the encryption key in a file that is not accessible to the web
              > server and then read it in using <cffile>.
              >
              > You could then load it into the application scope and use it that way. It
              > wouldn't be in the database and it wouldn't be in a file accessible via FTP,
              > assuming you set up the proper permissions.
              >


              mmmm where would the cffile tag go? it would have to be someweher on a
              page withing the site. again, a reference to where the key is. if
              someone got ftp access, and found the page with the reference, they
              could just make a page that would output that application variable and
              then they would have the key.

              the key, or any reference to where it is located cannot be on any page
              accessible via ftp.

              but the variable itself needs to be available to the web app.

              is there any way to load a variable into a session scope before anything
              else happens? like specify it in cfadmin or something...