As of MainWP version 4.5, MainWP introduced a better encryption system for storing 3rd-Party API Keys and Login details.
To provide better security for MainWP users, we implemented a more complex encryption process to store sensitive data in the MianWP Dashboard, as per the industry security standards.
Please note that this does not include data that may be created by third-party plugins on the Child Sites. Let's take one of the MainWP Extensions used for backups. MainWP will securely encrypt API key used by the MainWP extension. However, we do not encrypt data or backups which may be created by the respective backup plugin on a Child Site.
The process now includes:
IV (Initialization Vector) as 16 chars random string
Authentication data
AES GCM (Galois Counter Mode) encryption via PHPSecLib
Usage of PHPSecLib (version 3) `Random` class for generating random strings
Usage of Key File
What is AES GCM
AES GCM (Galois Counter Mode) is a stream cipher mode for AES. It is based on the CTR mode but is converted into a stream cipher. This provides low latency in the encryption/decryption process and is fast to process. As it is a stream cipher, it does not require padding.
Along with this, it integrates AEAD (Authenticated Encryption with Associated Data) for the authentication of the message. With AES-GCM, we have an encryption key and a message and then generate the cipher, a random nonce, and an authentication tag (a Message Authentication Code (MAC)).
Process Workflow
Create Encryption Key as 32 chars random string by using PHPSecLib (version 3) Random class
Create IV (Initialization Vector) as 16 chars random string by using PHPSecLib (version 3) Random class
Initialize AES GCM encryption instance
Set previously created encryption key from Step 1
Set encryption nonce with previously created IV from Step 2
Set Authentication data
Encrypt value (3rd-Party API Key) via AES GCM Encryption
Generate AES Tag
Generate Encrypted Value by merging IV from Step 2, previously encrypted data from Step 4, and AES tag from Step 5
Encode the encrypted value from Step 6 with base64_encode() and save it
Save the Key File
Save the Key File info to the Database
