Data encryption

  New LS4 feature

Introduction

Sodium library is used to provide data encryption and decryption functionality for LimeSurvey.

Sodium is a modern, easy-to-use software library for encryption, decryption, signatures, password hashing and more. It is a portable, cross-compilable, installable, packageable fork of NaCl, with a compatible API, and an extended API to improve usability even further. Its goal is to provide all of the core operations needed to build higher-level cryptographic tools.

Sodium is cross-platforms and cross-languages. It runs on a variety of compilers and operating systems, including Windows (with MinGW or Visual Studio, x86 and x86_64), iOS and Android. Javascript and WebAssembly versions are also available and are fully supported. Bindings for all common programming languages are available and well-supported.

Version 7.2.0 and newer of the PHP programming language includes the Sodium extension (referred to as ext/sodium) as a core cryptography library. Version 2 of the PHP extension in PECL is compatible with ext/sodium in PHP 7.2.

LimeSurvey use Sodium Compat library to bridge with different PHP versions. This library tentatively supports PHP 5.2.4 - 7.x (latest), but officially only supports non-EOL'd versions of PHP.

Data encryption/decryption methods used in LimeSurvey are based on public-key signatures. Public and secret keys can be found in /application/config/security.php file. Keys are automatically generated on first usage of encryption feature.

Settings

There are three places in LimeSurvey where data encryption is implemented:

Question/responses

Question attribute "Encrypted" is used to enable data encryption for responses. This attribute is turned off by default. Once survey is activated, it is not possible to change this attribute.

Participant attributes

Three core attributes (firstname, lastname and email) are always shown in attribute table and are encrypted by default. Encryption can be turned off at any moment.

Central participant database

Three core attributes (firstname, lastname and email) are always shown in attribute table and are encrypted by default. Encryption can be turned off at any moment.