How to safety store passwords in mysql to decrypt them later in php, not hash?

Needed to store passwords in mysql from other services. Hash not work, i needed to decryt passwords. How to safety to do that? Only that i think safe way is to use hardware token with decrypt key? Is there any other issues? Sorry my bad English.

Solution

You ask how to safely to store encrypted data in MySQL in a way in which it can be decrypted automatically.

Here's the thing: encrypting and decrypting itself is easy. Php offers the mcrypt package. http://php.net/manual/en/mcrypt.examples.php

The safety of such a procedure depends, however, on secure key management. If the app you use with MySQL is capable of decrypting the data, and the key is available to it, then a cybercriminal who penetrates your system will have access to it. Cybercriminals can read your php code, see how you decrypt this data, and do it themselves. So the safety of this process depends on how hard it is for your opponents to obtain your keys.

I suppose you could create a web service that accepted encrypted data and returned decrypted data. That web service could hold the keys inside it. You could protect it in a few ways:

putting it behind a firewall
rate-limit it to a few dozen decryption operations per second
keep the decryption keys inside it.
log all operations (but not the decrypted data) and monitor the logs diligently.

Another possibility is to do something client side. The open-source password safe called Keepass http://keepass.info/ is a good example, and so is Bruce Schneier's password manager. https://www.schneier.com/blog/archives/2014/09/security_of_pas.html

One-way password hashing (http://php.net/manual/en/book.password.php) prevents decryption, but still allows password verification. It's much harder to steal passwords that are one-way hashed.

With respect, this is not a suitable project for an inexperienced person if the passwords protect valuable assets. Cybercriminals are way ahead of the rest of us.