279

What is the simplest way of doing two way encryption in common PHP installs?

I need to be able to encrypt data with a string key, and use the same key to decrypt on the other end.

The security isn't as big of a concern as the portability of the code, so I'd like to be able to keep things as simple as possible. Currently, I am using an RC4 implementation, but if I can find something natively supported I figure I can save a lot of unnecessary code.

10
  • 7
    Just XOR your string.
    – Thunraz
    Feb 13, 2012 at 14:28
  • 3
    For general purpose encryption, use defuse/php-encryption/ instead of rolling your own. May 11, 2015 at 4:37
  • 3
    Hands away from github.com/defuse/php-encryption - it is slower by orders of magnitude than mcrypt. May 11, 2015 at 16:12
  • 1
    @Scott Thinking along the lines of "this will probably not be the bottleneck" is what brought us a lot of bad software. May 12, 2015 at 14:30
  • 5
    If you're really encrypting/decrypting a lot of data to the point that the milliseconds it costs bogs your application down, bite the bullet and switch to libsodium. Sodium::crypto_secretbox() and Sodium::crypto_secretbox_open() are secure and performant. May 12, 2015 at 18:53

6 Answers 6

289
+500

Important: Unless you have a very particular use-case, do not encrypt passwords, use a password hashing algorithm instead. When someone says they encrypt their passwords in a server-side application, they're either uninformed or they're describing a dangerous system design. Safely storing passwords is a totally separate problem from encryption.

Be informed. Design safe systems.

Portable Data Encryption in PHP

If you're using PHP 5.4 or newer and don't want to write a cryptography module yourself, I recommend using an existing library that provides authenticated encryption. The library I linked relies only on what PHP provides and is under periodic review by a handful of security researchers. (Myself included.)

If your portability goals do not prevent requiring PECL extensions, libsodium is highly recommended over anything you or I can write in PHP.

Update (2016-06-12): You can now use sodium_compat and use the same crypto libsodium offers without installing PECL extensions.

If you want to try your hand at cryptography engineering, read on.


First, you should take the time to learn the dangers of unauthenticated encryption and the Cryptographic Doom Principle.

  • Encrypted data can still be tampered with by a malicious user.
  • Authenticating the encrypted data prevents tampering.
  • Authenticating the unencrypted data does not prevent tampering.

Encryption and Decryption

Encryption in PHP is actually simple (we're going to use openssl_encrypt() and openssl_decrypt() once you have made some decisions about how to encrypt your information. Consult openssl_get_cipher_methods() for a list of the methods supported on your system. The best choice is AES in CTR mode:

  • aes-128-ctr
  • aes-192-ctr
  • aes-256-ctr

There is currently no reason to believe that the AES key size is a significant issue to worry about (bigger is probably not better, due to bad key-scheduling in the 256-bit mode).

Note: We are not using mcrypt because it is abandonware and has unpatched bugs that might be security-affecting. Because of these reasons, I encourage other PHP developers to avoid it as well.

Simple Encryption/Decryption Wrapper using OpenSSL

class UnsafeCrypto
{
    const METHOD = 'aes-256-ctr';
    
    /**
     * Encrypts (but does not authenticate) a message
     * 
     * @param string $message - plaintext message
     * @param string $key - encryption key (raw binary expected)
     * @param boolean $encode - set to TRUE to return a base64-encoded 
     * @return string (raw binary)
     */
    public static function encrypt($message, $key, $encode = false)
    {
        $nonceSize = openssl_cipher_iv_length(self::METHOD);
        $nonce = openssl_random_pseudo_bytes($nonceSize);
        
        $ciphertext = openssl_encrypt(
            $message,
            self::METHOD,
            $key,
            OPENSSL_RAW_DATA,
            $nonce
        );
        
        // Now let's pack the IV and the ciphertext together
        // Naively, we can just concatenate
        if ($encode) {
            return base64_encode($nonce.$ciphertext);
        }
        return $nonce.$ciphertext;
    }
    
    /**
     * Decrypts (but does not verify) a message
     * 
     * @param string $message - ciphertext message
     * @param string $key - encryption key (raw binary expected)
     * @param boolean $encoded - are we expecting an encoded string?
     * @return string
     */
    public static function decrypt($message, $key, $encoded = false)
    {
        if ($encoded) {
            $message = base64_decode($message, true);
            if ($message === false) {
                throw new Exception('Encryption failure');
            }
        }

        $nonceSize = openssl_cipher_iv_length(self::METHOD);
        $nonce = mb_substr($message, 0, $nonceSize, '8bit');
        $ciphertext = mb_substr($message, $nonceSize, null, '8bit');
        
        $plaintext = openssl_decrypt(
            $ciphertext,
            self::METHOD,
            $key,
            OPENSSL_RAW_DATA,
            $nonce
        );
        
        return $plaintext;
    }
}

Usage Example

$message = 'Ready your ammunition; we attack at dawn.';
$key = hex2bin('000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f');

$encrypted = UnsafeCrypto::encrypt($message, $key);
$decrypted = UnsafeCrypto::decrypt($encrypted, $key);

var_dump($encrypted, $decrypted);

Demo: https://3v4l.org/jl7qR


The above simple crypto library still is not safe to use. We need to authenticate ciphertexts and verify them before we decrypt.

Note: By default, UnsafeCrypto::encrypt() will return a raw binary string. Call it like this if you need to store it in a binary-safe format (base64-encoded):

$message = 'Ready your ammunition; we attack at dawn.';
$key = hex2bin('000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f');

$encrypted = UnsafeCrypto::encrypt($message, $key, true);
$decrypted = UnsafeCrypto::decrypt($encrypted, $key, true);

var_dump($encrypted, $decrypted);

Demo: http://3v4l.org/f5K93

Simple Authentication Wrapper

class SaferCrypto extends UnsafeCrypto
{
    const HASH_ALGO = 'sha256';
    
    /**
     * Encrypts then MACs a message
     * 
     * @param string $message - plaintext message
     * @param string $key - encryption key (raw binary expected)
     * @param boolean $encode - set to TRUE to return a base64-encoded string
     * @return string (raw binary)
     */
    public static function encrypt($message, $key, $encode = false)
    {
        list($encKey, $authKey) = self::splitKeys($key);
        
        // Pass to UnsafeCrypto::encrypt
        $ciphertext = parent::encrypt($message, $encKey);
        
        // Calculate a MAC of the IV and ciphertext
        $mac = hash_hmac(self::HASH_ALGO, $ciphertext, $authKey, true);
        
        if ($encode) {
            return base64_encode($mac.$ciphertext);
        }
        // Prepend MAC to the ciphertext and return to caller
        return $mac.$ciphertext;
    }
    
    /**
     * Decrypts a message (after verifying integrity)
     * 
     * @param string $message - ciphertext message
     * @param string $key - encryption key (raw binary expected)
     * @param boolean $encoded - are we expecting an encoded string?
     * @return string (raw binary)
     */
    public static function decrypt($message, $key, $encoded = false)
    {
        list($encKey, $authKey) = self::splitKeys($key);
        if ($encoded) {
            $message = base64_decode($message, true);
            if ($message === false) {
                throw new Exception('Encryption failure');
            }
        }
        
        // Hash Size -- in case HASH_ALGO is changed
        $hs = mb_strlen(hash(self::HASH_ALGO, '', true), '8bit');
        $mac = mb_substr($message, 0, $hs, '8bit');
        
        $ciphertext = mb_substr($message, $hs, null, '8bit');
        
        $calculated = hash_hmac(
            self::HASH_ALGO,
            $ciphertext,
            $authKey,
            true
        );
        
        if (!self::hashEquals($mac, $calculated)) {
            throw new Exception('Encryption failure');
        }
        
        // Pass to UnsafeCrypto::decrypt
        $plaintext = parent::decrypt($ciphertext, $encKey);
        
        return $plaintext;
    }
    
    /**
     * Splits a key into two separate keys; one for encryption
     * and the other for authenticaiton
     * 
     * @param string $masterKey (raw binary)
     * @return array (two raw binary strings)
     */
    protected static function splitKeys($masterKey)
    {
        // You really want to implement HKDF here instead!
        return [
            hash_hmac(self::HASH_ALGO, 'ENCRYPTION', $masterKey, true),
            hash_hmac(self::HASH_ALGO, 'AUTHENTICATION', $masterKey, true)
        ];
    }
    
    /**
     * Compare two strings without leaking timing information
     * 
     * @param string $a
     * @param string $b
     * @ref https://paragonie.com/b/WS1DLx6BnpsdaVQW
     * @return boolean
     */
    protected static function hashEquals($a, $b)
    {
        if (function_exists('hash_equals')) {
            return hash_equals($a, $b);
        }
        $nonce = openssl_random_pseudo_bytes(32);
        return hash_hmac(self::HASH_ALGO, $a, $nonce) === hash_hmac(self::HASH_ALGO, $b, $nonce);
    }
}

Usage Example

$message = 'Ready your ammunition; we attack at dawn.';
$key = hex2bin('000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f');

$encrypted = SaferCrypto::encrypt($message, $key);
$decrypted = SaferCrypto::decrypt($encrypted, $key);

var_dump($encrypted, $decrypted);

Demos: raw binary, base64-encoded


If anyone wishes to use this SaferCrypto library in a production environment, or your own implementation of the same concepts, I strongly recommend reaching out to your resident cryptographers for a second opinion before you do. They'll be able tell you about mistakes that I might not even be aware of.

You will be much better off using a reputable cryptography library.

15
  • 3
    So, I am just trying to get the UnsafeCrypto working first. The encryption happens fine, but every time I run the decrypt, I am getting 'false' as the response. I am using the same key to decrypt, and passing true on the encode, as well as the decode. There is, what I assume is a typeo in the example, I am wondering if that is where my problem is coming from. Can you explain where the $mac variable is coming from, and should it simply be $iv?
    – David C
    Jul 6, 2015 at 21:33
  • 1
    @EugenRieck The OpenSSL cipher implementations are probably the only parts that don't suck, and it's the only way to leverage AES-NI in vanilla PHP. If you install on OpenBSD, PHP will be compiled against LibreSSL without the PHP code noticing a difference. Libsodium > OpenSSL any day. Also, don't use libmcrypt. What would you recommend PHP developers use instead of OpenSSL? Jul 22, 2015 at 15:43
  • 2
    Neither 5.2 nor 5.3 are supported anymore. You should instead look into updating to a supported version of PHP, such a 5.6. Sep 6, 2015 at 20:19
  • 1
    @BBeta paragonie.com/blog/2015/09/… Apr 6, 2017 at 18:45
  • 1
    I just did it as a demonstration of you want binary strings, not human-readabale strings, for your keys. Aug 26, 2017 at 16:10
208

Edited:

You should really be using openssl_encrypt() & openssl_decrypt()

As Scott says, Mcrypt is not a good idea as it has not been updated since 2007.

There is even an RFC to remove Mcrypt from PHP - https://wiki.php.net/rfc/mcrypt-viking-funeral

6
  • 6
    @EugenRieck Yes, that's the point. Mcrypt doesn't receive patches. OpenSSL receives patches as soon as any vulnerability is discovered, big or small.
    – Greg
    Sep 7, 2016 at 8:49
  • 7
    it would be better for such high-voted answer, to be there provided simplest examples too in answer. thanks anyway.
    – T.Todua
    Jan 18, 2018 at 17:33
  • guys, just FYI => MCRYPT IS DEPRECATED. capsing so everyone should know not to use it as it gave us a myriad of issues. It deprecated since PHP 7.1 if i'm not mistaken. Jun 3, 2019 at 10:29
  • Since PHP 7 the mcrypt function is remove from php codebase. So when using the latest version of php (which should be standard) you are not able to use this deprecated function anymore. Sep 12, 2019 at 13:09
  • You should also mention that Mcrypt has be depreciated since PHP 7.1.0 and removed as of PHP 7.2.0. Sep 9, 2020 at 3:06
22

Use mcrypt_encrypt() and mcrypt_decrypt() with corresponding parameters. Really easy and straight forward, and you use a battle-tested encryption package.

EDIT

5 years and 4 months after this answer, the mcrypt extension is now in the process of deprecation and eventual removal from PHP.

4
  • 39
    Battle tested and not updated for more than 8 years? Oct 9, 2014 at 9:57
  • 5
    Well, mcrypt is in PHP7 and not deprecated - that's good enough for me. Not all code is of OpenSSL's horrible quality and needs patching every few days. May 11, 2016 at 4:30
  • 4
    mcrypt is not just horrible with regards to support. It also doesn't implement best practices like PKCS#7 compliant padding, authenticated encryption. It won't support SHA-3 or any other new algorithm as nobody is maintaining it, robbing you of an upgrade path. Furthermore it used to accept things like partial keys, performing zero padding etc. There is a good reason why it is in the process of being gradually removed from PHP. May 12, 2016 at 15:09
  • 3
    In PHP 7.1, all mcrypt_* functions will raise an E_DEPRECATED notice. In PHP 7.1+1 (be it 7.2 or 8.0), the mcrypt extension will be moved out of core and into PECL, where people who really want to install it may still do so if they can install PHP extensions from PECL. May 20, 2016 at 11:59
13

Encrypting using openssl_encrypt() The openssl_encrypt function provides a secured and easy way to encrypt your data.

In the script below, we use the AES128 encryption method, but you may consider other kind of encryption method depending on what you want to encrypt.

<?php
$message_to_encrypt = "Yoroshikune";
$secret_key = "my-secret-key";
$method = "aes128";
$iv_length = openssl_cipher_iv_length($method);
$iv = openssl_random_pseudo_bytes($iv_length);

$encrypted_message = openssl_encrypt($message_to_encrypt, $method, $secret_key, 0, $iv);

echo $encrypted_message;
?>

Here is an explanation of the variables used :

message_to_encrypt : the data you want to encrypt secret_key : it is your ‘password’ for encryption. Be sure not to choose something too easy and be careful not to share your secret key with other people method : the method of encryption. Here we chose AES128. iv_length and iv : prepare the encryption using bytes encrypted_message : the variable including your encrypted message

Decrypting using openssl_decrypt() Now you encrypted your data, you may need to decrypt it in order to re-use the message you first included into a variable. In order to do so, we will use the function openssl_decrypt().

<?php
$message_to_encrypt = "Yoroshikune";
$secret_key = "my-secret-key";
$method = "aes128";
$iv_length = openssl_cipher_iv_length($method);
$iv = openssl_random_pseudo_bytes($iv_length);
$encrypted_message = openssl_encrypt($message_to_encrypt, $method, $secret_key, 0, $iv);

$decrypted_message = openssl_decrypt($encrypted_message, $method, $secret_key, 0, $iv);

echo $decrypted_message;
?>

The decrypt method proposed by openssl_decrypt() is close to openssl_encrypt().

The only difference is that instead of adding $message_to_encrypt, you will need to add your already encrypted message as the first argument of openssl_decrypt().

Note: The secret key and iv needs to be saved in order to decrypt.

4
  • 1
    unless I didn't read properly, I think its worth noting that the secret key and iv needs to be saved if you want to decrypt later. I couldn't get mine going until I realized this reading this link php.net/manual/en/function.openssl-encrypt.php#example-903
    – gstlouis
    Jun 3, 2021 at 13:52
  • AGREED with gstlouis, I had to retract my up-vote because the code posted failed to take this in to consideration. However it serves as a 90% foundation and doesn't dump class nonsense in to the mix.
    – John
    Aug 6, 2021 at 6:38
  • 1
    Updated the code as oer @gstlouis advice.
    – Lonare
    Mar 31, 2022 at 17:55
  • Sorry - how do you get the $iv? I have tried displaying it and saving it to file but display is not readable and the text saved looks a bit like base64 encoded or something. I guess saving that in a script is better than a clear text password at least.
    – Steve
    Oct 30, 2022 at 21:57
6

PHP 7.2 moved completely away from Mcrypt and the encryption now is based on the maintainable Libsodium library.

All your encryption needs can be basically resolved through Libsodium library.

// On Alice's computer:
$msg = 'This comes from Alice.';
$signed_msg = sodium_crypto_sign($msg, $secret_sign_key);


// On Bob's computer:
$original_msg = sodium_crypto_sign_open($signed_msg, $alice_sign_publickey);
if ($original_msg === false) {
    throw new Exception('Invalid signature');
} else {
    echo $original_msg; // Displays "This comes from Alice."
}

Libsodium documentation: https://github.com/paragonie/pecl-libsodium-doc

1
  • 2
    The crypto_sign API does not encrypt messages - that will require one of the crypto_aead_*_encrypt functions. Jul 17, 2019 at 18:07
3

IMPORTANT this answer is valid only for PHP 5, in PHP 7 use built-in cryptographic functions.

Here is simple but secure enough implementation:

  • AES-256 encryption in CBC mode
  • PBKDF2 to create encryption key out of plain-text password
  • HMAC to authenticate the encrypted message.

Code and examples are here: https://stackoverflow.com/a/19445173/1387163

2
  • 1
    I'm not a cryptography expert, but having a key derived directly from a password seems like terrible idea. Rainbow tables + weak password and gone is your security. Also your link point to mcrypt functions, that are deprecated since PHP 7.1
    – Slava
    Apr 22, 2018 at 10:45
  • @Alph.Dev you are correct the answer above is only valid for PHP 5 Jan 10, 2020 at 12:44

Not the answer you're looking for? Browse other questions tagged or ask your own question.