everyone. I’m learning Laravel and I’m in the start of my journey. I was learning about encryption and decryption in Laravel today and then this thought came into my mind. Could be a stupid one but I want to know my answers.
Let’s say I make a database which stores sensitive information about users and I encrypt all the data before storing into the database, let’s just say using the Encrypt class of Laravel. Now my questions:
- If someone steals that database and luckily finds out that this information was encrypted using techniques provided by Laravel or any other technique. Can’t that person descript that all data using the same decryption technique that was used to encrypt it. If this can be done, then what’s the point of doing this encryption?
- If that can be done then how can we make sure that our data is actually encrypted and is safe even if someone steals it?
Thank you guys!
I encrypted my data and then decrypted it and want my answer that how that encrypted data is even safe.
2
Answers
If someone steals that database and luckily finds out that this information was encrypted using techniques provided by Laravel or any other technique. Can’t that person descript that all data using the same decryption technique that was used to encrypt it. If this can be done, then what’s the point of doing this encryption?
If someone steals that database they will still need a decryption key to decrypt (thats why strong passwords are recommended) so even if they bruteforce it will become almost impossible to decrypt.
The way you’re asking if encrypt and decrypt is easy then i think you’re asking some encryption like base64.
With AES bruteforcing their way in becomes difficult. In laravel encrypt or crypt class it uses AES-256-CBC which is pretty good at that.
Then there is Hash library they are one way encryption techniques which uses bcrypt it can only be verified and not decrypt you have to run all combinations for lines everytime to brute force. Unlike md5 which gives same encryted string every time.
You might want to read up on the basics of encryption.
The common approach is that the technique by which you encrypt should be as open as possible – because the more people look at the algorithm, the less likely there might be bugs.
However, even if the algorithm is public, the key is not. Only people who have the key can decrypt properly encrypted data. This is true of the AES algorithm Laravel uses too.
The mathematics are complicated, but essentially the length of the key determines the amount of computer resources required to break the encryption.
THe real-world example is that everyone knows how door locks work. There are millions of locks that all work in the same way – but only people who have a key can open the door.
So, if an attacker steals your database, they cannot read your content unless they also have the key, as long as the key length is sufficient.