ioncube / php-openssl-cryptor

Example

php-openssl-cryptor

Description

Simple to use class for encrypting/decrypting using the PHP Openssl library.

The Cryptor class supports arbitrary encryption and key hashing algorithms, along with raw, base64 and hex encoding of the encrypted data. Static convenience methods are provided for the default of AES, but a cryptor instance can be used for more flexibility. The default uses aes-256-ctr to avoid the need for padding and the related issues. Unfortunately GCM cannot be used as the PHP openssl module does not provide a way to retrieve the GCM tag. This is proposed to be remedied in PHP 7.1 when associated data can be retrieved.

php-openssl-cryptor's Issues

Hashing the key

Why the key hashed with php::openssl_digest()? As far as I understand, real strong encryption relies on the initial vector, the key's hash doesn't matter here.. I read the manual about php::openssl_encrypt(), explored examples and comments there, read openssl enc wiki. I saw the comment about password/key subtitution, but I think, yours intention was in something else. So, what the point?

Packagist support

Why not submitting this library on packagist in order to retrieve it via composer?

can't decrypt on new server

Hi,

I use this simple class on one of my projects.
I use it only with custom key:
Cryptor::Encrypt('[email protected]', $kkey);
on this server, all works ok.

But I need to go to a new one .. after code transfer and get data from DB I can't decrypt encrypted data..
I get some utf string like - ί�]�͇�a���Mٗ�����6����

If I re-encrypt string and decrypt it all is working fine again .. what I miss?
How to use it to be able to future data transfer to a new server?

P.S. I use the same PHP version on same ubuntu servers
PHP Version 7.2.24-0ubuntu0.18.04.4

mcrypt deprecated and removed from php 7.2

An FYI that as of PHP 7.1 mycrypt is deprecated and removed entirely from version 7.2.

Changing the Initialization vector?

I made a pull request to remove the call to mcrypt that's still in the file. It can be replaced with an openSSL call, your code will still work.

   // Build an initialisation vector	
   // Replacing all mcrypt calls
    // $iv = mcrypt_create_iv($this->iv_num_bytes, MCRYPT_DEV_URANDOM);
   
    // Build an initialisation vector
    $iv = openssl_random_pseudo_bytes($this->iv_num_bytes, $isStrongCrypto);
    if (!$isStrongCrypto) {
        throw new \Exception("Not a strong key");
    }

$iv should not be const/static

According to the documentation, $iv (A non-null initialization vector) in openssl_encrypt as well in openssl_decrypt should be random in every environment. However, currently, it is static for the PHP package. For AES-256-CTR it should be 16 bytes.

php-openssl-cryptor/src/Cryptor.php

Line 61 in f62397b

$this->iv_num_bytes = openssl_cipher_iv_length($cipher_algo);

Storing encrypted data in database

Before storing in a database I dump the values of encrypted and then decrypted:
string(32) "6ZoQPJRUhhPM6mKOaOaLQ3Kq0/Jrjw=="
string(6) "qwerty"

Then on retrieving from the database I get:
string(32) "6ZoQPJRUhhPM6mKOaOaLQ3Kq0/Jrjw=="
string(6) "�@ ��>"

The encrypted string looks the same. Why does it not decrypt properly after getting from the database?

I've tried using VARCHAR, VARBINARY and BINARY fields to store the encrypted data.