Securely store password in database and then show it on demand? [closed]

Question

I have written a small password manager script for my own purposes. It is hosted locally and cannot be accessed outside my local network. You can see the code on GutHub

I know it is better to encrypt the passwords before storing them in the database, but how to retrieve them back when viewing the record? I mean I don't need to verify the password but see it's actual value.

There are some options, but they all require a "key" or "salt" that will be hardcoded in the files and can be viewed by anyone. One that I though to use is this:

// Store the cipher method
$ciphering = 'AES-128-CTR';

// Use OpenSSl Encryption method
$iv_length = openssl_cipher_iv_length($ciphering);
$options = 0; # the AES options

// Non-NULL Initialization Vector for encryption
$encryption_iv = '4828992577348297';

// Store the encryption key
$encryption_key = 'tEDo5MHxsqiq6dtXgr7za8EzhXuQqG';

$this->pass_crypted = openssl_encrypt($this->password, $ciphering, $encryption_key, $options, $encryption_iv);

I am thinking of putting $encryption_iv and $encryption_key in a file outside the "project" folder and including the file when needed. Are there any other ways?

Answer 1

Are there any other ways?

You can derive your key and IV using the PBKDF2 password-based key hashing algorithm. This algorithm is supported by PHP.

There's even an entire specification dedicated to it: PKCS #5

The usual warnings about implementing/using cryptography in your projects apply: Don't roll your own crypto - This means don't design your own cryptographic scheme, don't implement a specification without understanding any and all potential pitfalls of MIS-implemmenting them.