php - Two-key encryption/decryption? -

i'm looking store sensitive data using php , mysql , using form of reversible encryption since need data out in plain text of use.

i'll deriving encryption key users' username/password combination i'm stumped in (inevitable) event of password being forgotten. realise purpose of encryption can undone using correct key must have been addressed before..

i'm trying head around whether or not public key cryptography apply problem can think of private key still need correct decrypt data..

any ideas?

i'm looking store sensitive data using php , mysql , using form of reversible encryption since need data out in plain text of use.

protecting sensitive data good. now:

• whose data it? (yours, user's, or third party?)
• what need protected from? (disclosure, corruption (accidental or intentional...)
• who need protected
  • uninvolved parties goes without saying.
  • do need / want avoid accessing plaintext data (useful deniability),
  • do need protect either user's data being visible third party,
  • or third party's data user,
  • or data user or third party?
• what attacks?
  • do need protect in case server compromised?
  • do need protect against application level attack user gains access not available data (e.g. access sql database, not filesystem)?
  • will amount of data small enough attacker can guess , check whether he/she got right? (short passwords, numbers, simple words, fixed form text candidates)
  • will attacker have known plaintext attack?
• is better data go away (or re-retrieve data) if user forgets password, or worth increased risk of exposing data avoid cost?

there other questions, type of thing want think when using encryption. answers figure out need vs. want, , point in right direction. might not want share of answers us.

i'll deriving encryption key users' username/password combination i'm stumped in (inevitable) event of password being forgotten. realise purpose of encryption can undone using correct key must have been addressed before..

you might have decided on solution without considering impact. doesn't mean solution wrong, question suggests should think willing risk security. data risked.

i'm trying head around whether or not public key cryptography apply problem can think of private key still need correct decrypt data..

this sounds solution in search of problem. public key cryptography useful when have 2 (or more) separate actors interest in communicating data between them. actors can real (people) or functional (components of system), without 2 actors, there no reason have separate public , private key.