Gordon is some what right but really it depends what you are trying to protect against and the acceptable level of risk. There is always risk so you have to decide what is OK.

If you want to make sure the data is protected in the database at rest which will then protect it when stored in back ups, transfered to a slave and other things then you can build in encryption into the code that accesses the data. This could also protect you against some code vulnerabiilites but not all, too abstract to get into since we don't know what cold be in the code, etc..

If you want to protect from those who might have access to the code (legit or not) and thus the keys, you need to add some key management to the process. most of the solutions I have used in the past called a complied app that went out and got the key or used a third party key management solution.

At any rate, might be more than what you are looking to do.

Adam

On Tue, Feb 3, 2009 at 3:05 PM, Gordon Heydon gordon@heydon.com.au wrote:

HI,

Because of how PHP works is is not really possible to encrypt data within the Drupal database.

basically the problem is that to encrypt and decrypt the data you will need the private key, so any person who wants to find decrypt the data will most likely have full access to the private key and all the code to decrypt it. Even to the point of just calling directly the same php code to get the get the clear text.

I would love to be able to do this for e-Commerce, but there is no way to keep it 100% safe. If they have access to the database, the rest is available to get the clear text version.

Gordon.

On 04/02/2009, at 5:56 AM, Steve Kessler wrote:

...

I am trying to make a site that will hold some sensitive information that I would like to have at least minimal encryption on some of my CCK fields. Is there an easy way to encrypt CCK text fields? I would need to display the un-encrypted values when the nodes were viewed by users with the correct permissions.

Thanks, Steve

Steve Kessler Denver DataMan 303-587-4428 Sign up for the Denver DataMan Free eNewsletter

-- [ Drupal support list | http://lists.drupal.org/ ]

-- [ Drupal support list | http://lists.drupal.org/ ]

MD5 is a hash, not encryption. It is one way.

On Tue, Feb 3, 2009 at 3:26 PM, Steve Kessler skessler@denverdataman.comwrote:

I am a little confused. How is this done with passwords using MD5? I would happy with MD5 encryption. I would love to understand this if I am missing something.

Thanks, Steve

Steve Kessler Denver DataMan 303-587-4428 Sign up for the Denver DataMan Free eNewsletter

-----Original Message----- From: Gordon Heydon [mailto:gordon@heydon.com.au] Sent: Tuesday, February 03, 2009 4:05 PM To: support@drupal.org Subject: Re: [support] Encrypting CCK Data

HI,

Because of how PHP works is is not really possible to encrypt data within the Drupal database.

basically the problem is that to encrypt and decrypt the data you will need the private key, so any person who wants to find decrypt the data will most likely have full access to the private key and all the code to decrypt it. Even to the point of just calling directly the same php code to get the get the clear text.

I would love to be able to do this for e-Commerce, but there is no way to keep it 100% safe. If they have access to the database, the rest is available to get the clear text version.

Gordon.

On 04/02/2009, at 5:56 AM, Steve Kessler wrote:

...

I am trying to make a site that will hold some sensitive information that I would like to have at least minimal encryption on some of my CCK fields. Is there an easy way to encrypt CCK text fields? I would need to display the un-encrypted values when the nodes were viewed by users with the correct permissions.

Thanks, Steve

Steve Kessler Denver DataMan 303-587-4428 Sign up for the Denver DataMan Free eNewsletter

-- [ Drupal support list | http://lists.drupal.org/ ]

-- [ Drupal support list | http://lists.drupal.org/ ]

-- [ Drupal support list | http://lists.drupal.org/ ]

Quoting Steve Kessler skessler@denverdataman.com:

I am a little confused. How is this done with passwords using MD5? I would happy with MD5 encryption. I would love to understand this if I am missing something.

As others have tried to explain MD5 hashes are one directional, there is no method to allow for giving back the original string. However, every time you pass the same string to MD5 you get the same hash result. You can have a look to http://us.php.net/manual/en/book.mcrypt.php and the PEAR encryption packages at http://pear.php.net/packages.php?catpid=6&catname=Encryption&php=all.

-- Earnie http://r-feed.com Make a Drupal difference and review core patches.

-- http://for-my-kids.com/ -- http://give-me-an-offer.com/