4 ms·

What would you guys recommend for encrypting a base64 file stored in database. I've found about scrypt and LZ-String, but not sure what would be best practice

What would you guys recommend for encrypting a base64 file stored in database. I've found about scrypt and LZ-String, but not sure what would be best practice here.

iso8859-1 6y ago
did you read the article? there is no reason to encrypt passwords. scrypt is a popular KDF, i think you'll be fine with that.
- agustif 6y ago
  Yes I did read the article, It's not a password, it's a PDF file, it's contents I store them as plain base64 now, but I'd rather have store them in a more secret fashion in case of a leak... If that makes sense...
  - iso8859-1 6y ago
    for the encryption itself, you can use e.g. LibSodium or AES (in a sensible mode!!!). of course, you'll need a key too, which is where you can use a KDF. but without knowing more about your threat model, it is hard to tell you how to do the key derivation.
    - agustif 6y ago
      Hey thanks, well I'm a bit out of my area here but that sounds helpful and will research it, thanks!!
    - StavrosK 6y ago
      Most of that is too low-level, libsodium/nacl is closer to what they want.
  - StavrosK 6y ago
    libsodium?
TheDong 6y ago
Neither scrypt nor lzma are encryption. If you use scrypt, you won't be able to get the file back out ever again. If you use lzma, it's compressed, not encrypted, and anyone who gets the compressed data can trivially decompress it. Consider using an nacl secretbox if you need to encrypt it. Consider very carefully where you'll store the password. Does the user input it each time they access the file (in which case use a key-derivation-function on their password)? Do you encrypt it with an application key? Per-user key stored in vault? Do you have a hardware encryption tool available (an HSM) or something like aws KMS? Your encryption is only as secure as you keep the encryption keys. See also [0] for some suggestions. [0]: https://latacora.micro.blog/2018/04/03/cryptographic-right-answers.html https://latacora.micro.blog/2018/04/03/cryptographic-right-a...
- agustif 6y ago
  Thanks for all the tips and the link, will research further and see what better suits my needs. For now I'm most worried about db being leaked so would look into db encryption and prob I will go with application-key
cogman10 6y ago
What are you trying to accomplish? I don't know why you are base64 encoding things before sending them to the DB. Just use a binary blob. scrypt is a hashing algorithm, not an encryption algorithm. So that doesn't seem like what you want. LZ-String is a compression algorithm, that's trivially reversible. The problem you'll run into is that the "right" encryption algorithm is constantly changing. Probably the best thing to do would be to not do it yourself, instead, rely on encryption capabilities of your DB if provided. If you opt to doing your own encryption, then be prepared to constantly maintain and update it. Pushing that responsibility onto the DB makes that burden a simple "make sure your DB is up to date" Which you should be doing anyways.

What would you guys recommend for encrypting a base64 file stored in database. I've found about scrypt and LZ-String, but not sure what would be best practice here.

iso8859-1 6y ago

did you read the article? there is no reason to encrypt passwords. scrypt is a popular KDF, i think you'll be fine with that.

agustif 6y ago
Yes I did read the article, It's not a password, it's a PDF file, it's contents I store them as plain base64 now, but I'd rather have store them in a more secret fashion in case of a leak... If that makes sense...
- iso8859-1 6y ago
  for the encryption itself, you can use e.g. LibSodium or AES (in a sensible mode!!!). of course, you'll need a key too, which is where you can use a KDF. but without knowing more about your threat model, it is hard to tell you how to do the key derivation.
  - agustif 6y ago
    Hey thanks, well I'm a bit out of my area here but that sounds helpful and will research it, thanks!!
  - StavrosK 6y ago
    Most of that is too low-level, libsodium/nacl is closer to what they want.
- StavrosK 6y ago
  libsodium?

TheDong 6y ago

Neither scrypt nor lzma are encryption. If you use scrypt, you won't be able to get the file back out ever again. If you use lzma, it's compressed, not encrypted, and anyone who gets the compressed data can trivially decompress it. Consider using an nacl secretbox if you need to encrypt it. Consider very carefully where you'll store the password. Does the user input it each time they access the file (in which case use a key-derivation-function on their password)? Do you encrypt it with an application key? Per-user key stored in vault? Do you have a hardware encryption tool available (an HSM) or something like aws KMS? Your encryption is only as secure as you keep the encryption keys. See also [0] for some suggestions. [0]: https://latacora.micro.blog/2018/04/03/cryptographic-right-answers.html https://latacora.micro.blog/2018/04/03/cryptographic-right-a...

agustif 6y ago
Thanks for all the tips and the link, will research further and see what better suits my needs. For now I'm most worried about db being leaked so would look into db encryption and prob I will go with application-key

cogman10 6y ago

What are you trying to accomplish? I don't know why you are base64 encoding things before sending them to the DB. Just use a binary blob. scrypt is a hashing algorithm, not an encryption algorithm. So that doesn't seem like what you want. LZ-String is a compression algorithm, that's trivially reversible. The problem you'll run into is that the "right" encryption algorithm is constantly changing. Probably the best thing to do would be to not do it yourself, instead, rely on encryption capabilities of your DB if provided. If you opt to doing your own encryption, then be prepared to constantly maintain and update it. Pushing that responsibility onto the DB makes that burden a simple "make sure your DB is up to date" Which you should be doing anyways.