Security with encrypt, decrypt key- is it safe?

php security encrypt, decrypt

[theborland]

Hi all,
Im a little new to this security game and I need some input.
Im doing a medical info site, so data needs to be extremely secure, although its not too interesting.(Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule - requires this to be secure).
The only really private tihng is clients names.
So what im doing is having the providers put in a passcode with their login. I dont know the passcode. When they try to retrieve data, it is decrypt w/ the key and when they enter data it is encrypt with their key (again that i dont know). it goes into my database encrypt and i have no idea what it is).
The encryption script is below ( i found it somewhere online).
My questions are:
1) is this safe? why or why not?
2) is there a better way?

thanks for all the input,
jeff

function encrypt($string, $key) {
$result = '';
for($i=0; $i<strlen($string); $i++) {
$char = substr($string, $i, 1);
$keychar = substr($key, ($i % strlen($key))-1, 1);
$char = chr(ord($char)+ord($keychar));
$result.=$char;
}

return base64_encode($result);
}

function decrypt($string, $key) {
$result = '';
$string = base64_decode($string);

for($i=0; $i<strlen($string); $i++) {
$char = substr($string, $i, 1);
$keychar = substr($key, ($i % strlen($key))-1, 1);
$char = chr(ord($char)-ord($keychar));
$result.=$char;
}

return $result;
}

[jatar_k]

Welcome to WebmasterWorld theborland,

>> The only really private thing is clients names.

if you store addresses, emails or anything else that pertains specifically to these customers then that qualifies as well.

if the decrypt function is stored on the same server as the encrypted data then it isn't really secure.

do you have https? if not then this data is sent over an unencrypted connection and that is an issue.

Nothing is ever truly secure, though using one way encryption such as MD5 for passwords is an accepted standard (yes, I know MD5 can be cracked too). So using MD5 to encrypt the password before you put it in the db is fine. Then have a forgot password that generates a new password and forces them to change it on next login would be acceptable.

we have some library [webmasterworld.com] threads that might be of interest
PHP User Authentication and Passwords [webmasterworld.com]
PHP Security [webmasterworld.com]

[theborland]

literally the only private info is their names.
and i will use md5 for hte user passwords.
but how is the key idea, does it do much of anything, or is it an inconvenience.

are there better encrypt with key codes out there,
thanks,
jeff

[jatar_k]

trouble is if you encrypt something and the key/function to decrypt is on the same server then it is not secure

[PHP_Chimp]

The encrypt function that you have is similar to a payment providers simpleXor function that is included with there information for integrating there payment services onto websites. This is to 'encrypt' the information sent from your site to there site. So that includes there personal details and shopping cart, there are no card details. So this is a similar level of information as you are handling.
Below is the comment that they put with there function -

/* The SimpleXor encryption algorithm **
** NOTE: This is a placeholder really. Future releases of $$$ Form will use AES or TwoFish. Proper encryption **
** This simple function and the Base64 will deter script kiddies and prevent the "View Source" type tampering **
** It won't stop a half decent hacker though, but the most they could do is change the amount field to something **
** else, so provided the vendor checks the reports and compares amounts, there is no harm done. It's still **
** more secure than the other PSPs who don't both encrypting their forms at all */

There function obscures the data more efficiently than yours, however as they say it is still just a placeholder, not proper encryption.
If you are after proper encryption then you will need to look through php's encryption functions.
Seeing as in a lot of countries leaking private data is a crime, you may well need to think very carefully about the level of encryption you use for your data. Look at what other people have done, as this is the standard by which you will be judged should it go to court.

When handling personal data of any description you can never be to careful.

[henry0]

Your ISP might provide a shared certif so you could and should use https. If not you need to find a decent host.

There are on the market a few certif for just a few $, check that out if name regognition is not an issue.