Decoding a hash

Question

I have some sensitive data in an online PHP application I am building. I want to store the data as a hash in the database, but that means I will have to decode the data every time I call it from the database. I know a hash is built to not be easily reversed engineered, so I would like to know what the best solution would be?

Unlike with passwords, I can't do a hash comparison - so how should I protect the information in the database?

Sounds like you need to encrypt the data with a private key. Hashes are not reversible, since more than one piece of data can result in the same hash. — Mike Christensen, Apr 11 '12 at 15:34

score 5 · Answer 1 · edited May 23 '17 at 11:56

5

What you're looking for is encryption, not hashing. Encryption is two way which means you can unencrypt to view the contents assuming you have the proper information for doing so (you do, snoopers don't).

See this post for code on how to do this with PHP.

edited May 23 '17 at 11:56

Community

1
1

answered Apr 11 '12 at 15:46

John Conde

217,595
99
455
496

1

Blowfish is not reccomended for new applications. I would suggest using AES, Serpent or Twofish (the successor to Blowfish) instead. – Chris Smith Apr 11 '12 at 15:54
Thanks for heads up. I'll have to update that code to reflect this. – John Conde Apr 11 '12 at 15:59

score 0 · Answer 2 · answered Apr 11 '12 at 15:52

Cryptographic hash functions are one-way functions, meaning that you cannot reverse them. What I presume you are looking for is encryption. You can use the Mcrypt or OpenSSL extensions to do this. My recommendation would be using AES with a 256-bit key (but remember that you need to keep the key secure) to encrypt the data before inserting it into the database and decrypting it upon retrieval. Now, you could use the methods provided by MySQL but I'd use Mcrypt myself. If you can provide the nature and approximate size of the data you are trying to keep secure I could recommend a suitable mode of operation.

score 0 · Answer 3 · answered Apr 11 '12 at 16:50

Try reading this article on web cryptography: http://www.alistapart.com/articles/web-cryptography-salted-hash-and-other-tasty-dishes/

You can encode variables using the SHA-1 hash as follows:

sha1('password')
=> 5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8

MySQL supports data encryption and decryption. Ex:

INSERT INTO people (pet_name) 
  VALUES (AES_ENCRYPT('Schmoopie','my-secret-key'));

SELECT AES_DECRYPT(pet_name, 'my-secret-key') AS pet_name
  FROM people;

Both of these examples are from the List Apart article.

Decoding a hash

3 Answers3