EPP Encrypt

Component ID

2274149

Component name

EPP Encrypt

Component type

module

Maintenance status

Development status

Component security advisory coverage

not-covered

Component created

Component changed

Component body

EPP Encrypt is implementing new way of encrypting fields in Drupal, it contain 2 modules:

EPP Encrypt Storage - SQL Storage implementation for encrypting data directly in Database. Currently support only for pgcrypto in PostgreSQL
EPP Encrypt Field - module with add new 2 fields for text and text area field encryption.

It require encrypt module from where is taking encryption key. It's enough to use Basic method and set encryption key out of public_html (root) folder.

Example of installing pgcrypto on PgSQL: http://dba.stackexchange.com/a/15884

Why creating this module?
There are few modules with offer encryption for fields. The different is that it offer encryption on application level - with mean that encryption is made in application and then saved into Database. My module is implementing encryption on database level using direct database query.

Advantages
You do not need care from programmer point of view about decryption data when display cause it will decrypt automatically when read from database.
Performance (?)
Depend from database type you can make some sorting or ordering data so no to much complicated views should work like on not encrypted fields
... something more?

Dis-advantages
More pain in implementation - I use PostgreSQL and AES 256 encryption - as pgcrypto extension. Some time ago was trying use MySQL witch 256 key length like here http://stackoverflow.com/questions/12872982/mysql-aes-encrypt-256-encryp... but I didn't success. I'm not using anymore MySQL so if someone would like support it I'm open for patches.
No possible for direct/index search - searching for data would be implemented on application level similar to views PHP module.
... something more?

Warning: This is very experimental code and not secure - don't use on production!
Main security issue: in case of error it show up encryption key in SQL error description!

More info very soon...