An Internal Apache Web Page to Encrypt Files?

[JRA]

Morning all - this is one I could really use some help with!

 

Full disclosure, a counterpart of mine has this in another school, and I'm too proud to ask for his version! Plus I'd learn very little, plus if we all fumble through the solution here then the whole world gets to see it. And how basic I am.

 

But anyways, my counterpart has at his school and internal web page. Users visit this page to upload a document and enter a password. Once done the page (php iirc) encrypts the document with the password specified PLUS a second, hidden password (so that the files can be decrypted by senior staff in future for the sake of accountability) and then after a bit of thinking time prompts the user to save the newly-encrypted file (I believe it zips them but not sure.)

 

Would anybody at all know how in the world I'd go about setting up something like this? If ANY ideas (even where to start) please do let me know! If I find out myself I'll post it up, and thanks muchly in advance for any pointers!

[Steve21]

Well if it's zipping them it's probably just running something like 7zip via commandline in the background then returning said zip as a downloadable file

 

Steve

[JRA]

Well if it's zipping them it's probably just running something like 7zip via commandline in the background then returning said zip as a downloadable file

 

Steve

 

Ah, now THAT I did ponder, but can that be done with the dual-password situation? If so I'll do that!

[Steve21]

Guess that depends how you do the decryption.

 

Do they need to re-upload it to get it decrypted? If so there's probably just a saved list somewhere/hash wise etc. (or makes a copy on the server when it's encrypting)

 

Steve

[JRA]

Guess that depends how you do the decryption.

 

Do they need to re-upload it to get it decrypted? If so there's probably just a saved list somewhere/hash wise etc. (or makes a copy on the server when it's encrypting)

 

Steve

 

Nah it's more for zipping it up, sending that file with an email and the password separately, and also the 'master'/hidden password should the school need to access the file at a later date. The resultant file can be decrypted with either the password set with its upload or the 'master' password.

[Steve21]

You sure it is a zip file then? As normal windows etc wouldn't accept two passwords on a zip usually.

 

I don't understand why you'd want two passwords on it really as if you're sending the zip externally it assumes your senior team wouldn't be viewing it, and you got the files locally so how would the senior team get the zip?. And if it's the recipients senior team they'd used the same passwords?

 

Steve

[pete]

You sure it is a zip file then? As normal windows etc wouldn't accept two passwords on a zip usually.

 

You could zip it twice, stash one zip in a secure location for accountability purposes and with a password known/available to SLT and return another to the user that's encrypted with their password.

 

I don't understand why you'd want two passwords on it really as if you're sending the zip externally it assumes your senior team wouldn't be viewing it, and you got the files locally so how would the senior team get the zip?. And if it's the recipients senior team they'd used the same passwords?

Steve

 

Accountability / spot checks to see if people are doing dumb / unlawful / malicious things with the data they have access to. If Fred's sending totallylegit.zip to someone externally and chooses a decent password, short of building a rackmount stuffed with Nvidia cards it's hard to determine what he actually emailed.

[Arthur]

You sure it is a zip file then?

Apparently it is possible to create .zip, .7z or .rar archives with multiple passwords if you use PeaZip or WinRAR.

 

https://superuser.com/questions/409675/is-it-possible-for-two-files-in-a-rar-to-have-different-passwords

 

Yes, every entry in a .rar file can be encrypted with a different password.

 

www.peazip.org/multiple-passwords.html

 

Most of mainstream archive formats standards (including 7Z, RAR, and ZIP / ZIPX) provides file-level encryption scheme.

 

That architecture choice means a single archive can be created to contain files encrypted with different passwords - ideally a different password for each file can be applied. Also, this allows a single archive to contain both encrypted and non-encrypted content, choosing to apply or not to apply password in each creation / update operation.

[Steve21]

Yep but that's a password per file, not two passwords to unlock a single file which is what was suggested Wouldn't let a senior member unlock another file with the same password etc.

 

And as I said I can understand a copy being made, but seems pointless to encrypt both then As the backup might as well just be stored locally in the first place so no password is required or the original file etc (remember its your system that's encrypting it so can do a copy before it's "safe" )

 

Steve