- Posts: 103
- Thank you received: 5
Ask the community, share ideas, and connect with other LimeSurvey users!
Topic Author
. I'm not a programmer and thus cannot implement these functionalities - I'm still interested to help wherever I can - but I hope that there are other more sophisticated LS users around who are interested (I think most of us working with data of EU citizens should be interested 
Topic Author
If you allow decrypting on server : there are no difference … you need to put the private key on the server … then server breach : security broken. [...] The only real solution is to decrypt only on local, not on other way and never share the private key. Then LimeSurvey GUI can not give access to data decrypted.
I think so - that sounds promising! My question here is, whether the responses have to be encrypted altogether or respondent-wise... The result of thinking about the response table so far (I repeat myself, but I hope this also gets more precise every time - does it?Encrypt all responses seems really the best solution, maybe we can add a way to : encrypt all response and delete some response answer when survey is submitted.
Thanks for your effort - and for reading this. Yes, and LimeSurvey is http accessible, not the database.As understand you @Denis, the encryption of the token table (or temporary decryption of the email-adresses etc. for sending out invitations, etc.) does not make sense, since the decryption on the server would render this insecure, right?
Security is here, but i'm unsure we have a way to do it easily …I see that the private key - that would be entered - could be intercepted, but if the latter is not the case: would that be a viable solution?
It can be only respondent-wise since it's done when user submit (for the last time) the survey.My question here is, whether the responses have to be encrypted altogether or respondent-wise...
Arg here, difficult too …The question is then, whether it's possible to decrypt the downloaded data directy in R.
Yes encrypt, not decrypt, right ?There is a number of packages in R for encrypting data
Current plugin do it after yes.be still able to pipe data from one survey to another via end-url (I guess the URL will be built before encrypting the data, right?) manual.limesurvey.org/Workarounds:_Surve...using_the_survey_URL
Topic Author
The question is, whether it's possible to use the same algorithm in Limesurvey for encryption and in R for decryption. That could be possible with the openssl-Package CRAN.R-project.org/package=openssl.
An envelope contains ciphertext along with an encrypted session key and optionally and initial-ization vector. Theencrypt_envelopegenerates a random IV and session-key which is used toencrypt thedatawithAESstream cipher. The session key itself is encrypted using the given RSAkey (seersa_encrypt) and stored or sent along with the encrypted data. Each of these outputs isrequired to decrypt the data with the corresponding private key
protected function encrypt($publicKey, $data) { // Generate a random password for symmetric encryption. $symmetricKey = openssl_random_pseudo_bytes(50); $encryptedKey = ''; if (openssl_public_encrypt($symmetricKey, $encryptedKey, $publicKey)) { // Use the encrypted key as basis for the IV. $iv = substr($encryptedKey, 0, mcrypt_get_iv_size(MCRYPT_BLOWFISH, MCRYPT_MODE_CBC)); $encryptedData = mcrypt_encrypt(MCRYPT_BLOWFISH, $symmetricKey, $data, MCRYPT_MODE_CBC, $iv); // Key has constant length so no separator is necessary. return $encryptedKey . $encryptedData; } /** * @todo Proper error handling. * */ }
and I will try to get funding for this part of my wishlist and contribute that way. I think I asked this somewhere before, but are there any crowdfunding plans where users could gather to collect budget for certain functions in R?