How to protect the encryption key in php?

Question

PHP

There is a task - to encrypt the data (details) of users in the database (postgresql).
I got acquainted with the question of another user . I did not find a clear answer.
Requirements: the data must be safe, even if they got access to the server, merged the database, got all the project scripts, and so on and so forth.
Previously used perl(dancer). There I solved the situation as follows: before starting the server, I loaded a text file with an encryption key. During dancer startup, the file was being read and deleted. The key was kept while the dancer was running. If: the dancer daemon crashed or a user with administrative rights entered, the encryption key was erased from memory.
Current development should be implemented in php.
I tend to the solution - writing a php extension that will pull the encryption key from a neighboring resource.

Answer 1

Do the same - store the key in memory.
In memcahed or in shared memory.
You can store in $ENV (for example, create a php-fpm config with $ENV set dynamically before launch and delete it after launch).
You just need to think about an automatic restart, you never know ...

Answer 2

A daemon (db-wrapper) is written to a socket that receives a key from a file (or another host) to decrypt the result of the database inside this daemon process. Key salt - stored inside this process, bound to a domain or MAC interface.
The daemon runs as a different user with reduced privileges than the web server and PHP.
It is possible to decrypt the data directly on the client via JS.
But, that's a completely different story....

Answer 3

Anyone who gains access to your server can put a breakpoint where the key was used and read it.
The idea with dancer is interesting, you can use a similar script and a variable in memory.

Answer 4

On the server, the key is stolen or the code that steals it is injected.
On the client, if you calculate, they will also replace the scripts and be able to steal.
So far, I see only one option - if a program signed by the author's EDS will be used as a client, which will not fully trust the server. And when downloading updates, check their EDS and only then install. As a result, even if the server is hacked, they will not receive the key with which the author signs the program and will not replace it, and the user's keys will not go anywhere beyond the client. Although here they can replace the program installer, but only new users will receive it.