Configuring an encryption key and salt in your site’s wp-config.php file for better security of voter data.
Before you install the Your Right Campaign GOTV plugin, you may wish to add a custom encryption key and salt to your site’s wp-config.php file for the highest level of security of your imported voter data. The steps in this section are completely optional, but highly recommended for the best data security of sensitive voter data.
How Voter Data Encryption Works
The plugin stores select voter data, including voter addresses, phone numbers and email addresses as encrypted data in the WordPress database. When the plugin is installed and activated, your site’s wp-config.php file will be checked for the presence of an encryption key and salt. If these values are not found in your wp-config.php file, the plugin will generate an encryption key and salt and store them in your site’s WordPress database.
Having your encryption key and salt stored in the database means that if anyone ever compromises your WordPress database and can download a copy, they’ll also have access to the keys necessary to decrypt your voter data. Moving these keys to your wp-config.php file instead reduces the risk of compromise of voter data, as now an attacker needs to compromise not only your database but also your website’s file system to gain access to the keys required to decrypt voter data.
Generating an encryption key and salt
You will need to generate two 64 character long hex encryption keys. If you have access to a PHP command line, you can generate the keys using the following command:
php -r "echo bin2hex(random_bytes(32)) . PHP_EOL;"
You’ll need to generate two keys, one for the encryption key and one for the encryption salt.
Before you install and activate the plugin, you’ll want to update your wp-config.php file with two new constants, GOTV_ENCRYPTION_KEY and GOTV_HMAC_SALT.
Your values should look like those below:
/* Custom constants for voter data encryption */
define( 'GOTV_ENCRYPTION_KEY', '67229b55f6f9e62763d492b16d52ea66922022ef36dd50d5495c1a1b9cef2b72' );
define( 'GOTV_HMAC_SALT', '75c6b8af78d21a84a06b154ffae1d3c60b3e5502aa1864f5b5c208be4ed02f8b' );
You’ll want to add these values to your wp-config.php file after the “Add any custom values between this line and the “stop editing” line.” entry in that file.
If you are unable to generate an encryption key using the command listed above, you can use any value for the encryption key and salt, however this will be significantly weaker than using a properly generated bin2hex key.
Using a server environment variable for the highest level of security
For the highest level of security, we recommend using a server environment variable for storage of your encryption key and salt. This approach will provide the best protection of voter data, as an environment variable completely removes your encryption key and salt from a location where an attacker could grab it from a compromised database or dump of your WordPress filesystem.
Moving your encryption key from your database to wp-config.php
If you previously configured the plugin without a custom encryption key and wish to move your current encryption key to your wp-config.php file instead of your site’s database, you can do so by grabbing the values of the gotv_encryption_key and gotv_hmac_salt options in your WordPress database, moving them to wp-config.php and then deleting those options from your WordPress database.
Don’t lose your encryption key or salt, as without these values you will be unable to decrypt your voter data!
Once you have configured your encryption key and salt in wp-config.php you’re ready to install and activate the Your Right Campaign GOTV plugin!