<p>I'm hardly a security expert but if someone can get to your filesystem or your db, you'd be screwed either way—so what you're really doing is technically obfuscation and not really encryption. Ideally you'd do the crypto on a different server or have a hardware module that does the encryption and sends the result back but that solution probably won't work here.</p>

<p>Like you mentioned, if you're storing data in the database, don't keep your key in the db. That would be like taping the combination to the outside of a safe. If someone got a dump of the database, they'd be able to use the key to decrypt the data, obviously. </p>

<p>Keep it simple. I'd probably opt for somewhere in the filesystem, like in your plugin's config for example. Leave the key blank until you're ready to use the plugin for production and then have the user fill in the value... maybe with something like <a href="http://api.wordpress.org/secret-key/1.1/" rel="nofollow">WordPress's Secret key generator</a>... that way, nobody has the same key even if someone were to get a copy of your plugin's source code.</p>

CC BY-SA 3.0
2015-02-17T18:11:29.983Z
+1 for on the file system or as an environment variable.
Brad Bell
CC BY-SA 3.0
2015-02-17T18:10:13.480Z
2015-02-17T18:10:13.480Z
RitterKnight
<p>I'm working on a plugin that needs to encrypt some user data. I'm setting an encryption key for SecurityService, but am trying to decide where to store that encryption key so it can be used on subsequent requests to decrypt the data. A few options are coming to mind:</p>

<ol>
<li><p><strong>StatePersister:</strong> this is where Craft keeps its cookie validation key, but is <a href="http://buildwithcraft.com/help/craft-storage-gitignore" rel="nofollow">likely to be ignored by .gitignore</a>, so probably wouldn't be persistent for long.</p></li>
<li><p><strong>Plugin Settings Table:</strong> this is the approach being used by the <a href="https://github.com/t3kila/SecureField-Craft/blob/master/secureField/secureFieldPlugin.php" rel="nofollow">SecureField Plugin</a>. It's very straightforward, but also minimally secure as pretty much any SQL injection attack would compromise the key <em>and</em> its encrypted data. The upside is that the key's persistence is practically guaranteed.</p></li>
<li><p><strong>Extend CStatePersister:</strong> This could be used to persist state in a writable location of my plugin's folder. It's more likely that this would be preserved in version control, but <em>not</em> very likely that the location will be writable on a production server.</p></li>
</ol>

<p>As it stands, storing the key in the database is the most likely to work on a wide variety of servers, but probably has the poorest level of security. Am I missing any other options? </p>

<plugin-development>
Where should an encryption key be stored?
# Where should an encryption key be stored?

(Asked by: username_0 on 2015-02-17)

I'm working on a plugin that needs to encrypt some user data. I'm setting an encryption key for SecurityService, but am trying to decide where to store that encryption key so it can be used on subsequent requests to decrypt the data. A few options are coming to mind:

1. **StatePersister:** this is where Craft keeps its cookie validation key, but is [likely to be ignored by .gitignore](http://buildwithcraft.com/help/craft-storage-gitignore), so probably wouldn't be persistent for long.
2. **Plugin Settings Table:** this is the approach being used by the [SecureField Plugin](https://github.com/t3kila/SecureField-Craft/blob/master/secureField/secureFieldPlugin.php). It's very straightforward, but also minimally secure as pretty much any SQL injection attack would compromise the key *and* its encrypted data. The upside is that the key's persistence is practically guaranteed.
3. **Extend CStatePersister:** This could be used to persist state in a writable location of my plugin's folder. It's more likely that this would be preserved in version control, but *not* very likely that the location will be writable on a production server.

As it stands, storing the key in the database is the most likely to work on a wide variety of servers, but probably has the poorest level of security. Am I missing any other options?

**Tags:** plugin-development


---

## 1 answers

### Answer by username_1 on 2015-02-17. Score: 2 | Accepted answer

I'm hardly a security expert but if someone can get to your filesystem or your db, you'd be screwed either way—so what you're really doing is technically obfuscation and not really encryption. Ideally you'd do the crypto on a different server or have a hardware module that does the encryption and sends the result back but that solution probably won't work here.

Like you mentioned, if you're storing data in the database, don't keep your key in the db. That would be like taping the combination to the outside of a safe. If someone got a dump of the database, they'd be able to use the key to decrypt the data, obviously.

Keep it simple. I'd probably opt for somewhere in the filesystem, like in your plugin's config for example. Leave the key blank until you're ready to use the plugin for production and then have the user fill in the value... maybe with something like [WordPress's Secret key generator](http://api.wordpress.org/secret-key/1.1/)... that way, nobody has the same key even if someone were to get a copy of your plugin's source code.

> **Comments:**
> **username_2**: +1 for on the file system or as an environment variable.  

---

