Best way to encrypt/decrypt a file uploaded via PHP for this purpose?

Question

I'm in the process of prototyping a file upload system for a service that needs a basic form of encryption for the files uploaded by users. All of the files uploaded will be uploaded to the same directory in which users can download and upload files freely, however only authorized users will be able to delete files from the uploads.

With this in mind, I need to know the best way to encrypt these files (via crypt() or similar) for storage in a non-public-accessible directory for this purpose. I considered using the base 64 encode functions built into PHP to do this, but it seemed as if someone would be able to write a PHP script on another server to base 64 decrypt the files stored on my server, thereby rendering the encryption protection completely useless.

In summary, I need to know the best way to implement this (i.e. which functions or classes to use) so that it meets the following criteria:

1. The function needs to be reversible in a way that only users logged in via PHP's $_SESSION variables can decrypt the files that are encrypted.
2. Encryption needs to affect all file types, whether it be images, text, binaries, documents, and decrypting the files must yield a file identical to the file that was encrypted (i.e. with the header intact).

I may be worried about more than necessary, but I would like to make this as easy to use as possible with basic security. I'm not protecting anything particularly important such as credit card information or trade secrets, but the users I am designing for would like to have the peace-of-mind to know that there are at least some measures in place to prevent hacking of the files uploaded.

Answer 1

base64 is not encryption.

If you want strong encryption, you'll want to think about using the GPG extension

Then you need to carefully consider your system architecture.

If the server needs to encrypt/decrypt files, the key will need to be on the server, and readable by the web server process. This means that if someone compromises your server, they probably have access to everything they need to decrypt your files!

Even worse, since your PHP app drives the encryption/decryption, all an attacker needs to do is get access to one of your users' accounts.

Encryption is only going to save you if an attacker somehow gets access to your file storage directory, but nothing else on the server. That's a very unlikely scenario.

In your case, it sounds like on-disk encryption is overkill. If the files are not directly web-accessible, that's probably enough. Focus instead on making sure the host system is secure (updated packages, good firewall rules), and that your application is secure (run it only under https, use best practices to defeat SQL Injection and CSRF attacks, require strong passwords, etc).