Section C.2.  Using mcrypt

C.2. Using mcrypt

The standard PHP extension for cryptography is mcrypt, and it supports a number of different cryptographic algorithms. To see which ones are supported on your platform, use the mcrypt_list_algorithms( ) function:

    <?php

    echo '<pre>' . print_r(mcrypt_list_algorithms(), TRUE) . '</pre>';

    ?>

Encrypting and decrypting data are achieved by using mcrypt_encrypt( ) and mcrypt_decrypt( ), respectively. Each of these functions accepts five arguments, the first of which is the algorithm to use:

    <?php

    mcrypt_encrypt($algorithm,
                   $key,
                   $cleartext,
                   $mode,
                   $iv);

    mcrypt_decrypt($algorithm,
                   $key,
                   $ciphertext,
                   $mode,
                   $iv);

    ?>

The key (second argument) is extremely sensitive, so you want to be sure to keep this in a safe place. The technique described in Chapter 8 for protecting your database access credentials can be used to protect the key. A hardware key provides superior security, and this is the best choice for those who can afford it.

There are numerous modes that you can use, and you can use mcrypt_list_modes( ) to view a list of available modes:

    <?php

    echo '<pre>' . print_r(mcrypt_list_modes(), TRUE) . '</pre>';

    ?>

The fifth argument ($iv) is the initialization vector, and it is created with the mcrypt_create_iv( ) function.

The following is an example class that offers basic methods for encrypting and decrypting:

    class crypt
    {
      private $algorithm;
      private $mode;
      private $random_source;

      public $cleartext;
      public $ciphertext;
      public $iv;

      public function __construct($algorithm = MCRYPT_BLOWFISH,
                                  $mode = MCRYPT_MODE_CBC,
                                  $random_source = MCRYPT_DEV_URANDOM)
      {
        $this->algorithm = $algorithm;
        $this->mode = $mode;
        $this->random_source = $random_source;
      }

      public function generate_iv()
      {
        $this->iv = mcrypt_create_iv(mcrypt_get_iv_size($this->algorithm,
          $this->mode), $this->random_source);
      }

      public function encrypt()
      {
        $this->ciphertext = mcrypt_encrypt($this->algorithm,
          $_SERVER['CRYPT_KEY'], $this->cleartext, $this->mode, $this->iv);
      }

      public function decrypt()
      {
        $this->cleartext = mcrypt_decrypt($this->algorithm,
          $_SERVER['CRYPT_KEY'], $this->ciphertext, $this->mode, $this->iv);
      }
    }

    ?>

This class is referenced in other examples; the following example demonstrates its use:

    <?php

    $crypt = new crypt();

    $crypt->cleartext = 'This is a string';
    $crypt->generate_iv();
    $crypt->encrypt();

    $ciphertext = base64_encode($crypt->ciphertext);
    $iv = base64_encode($crypt->iv);

    unset($crypt);

    /* Store $ciphertext and $iv (initialization vector). */

    $ciphertext = base64_decode($ciphertext);
    $iv = base64_decode($iv);

    $crypt = new crypt();

    $crypt->iv = $iv;
    $crypt->ciphertext = $ciphertext;
    $crypt->decrypt();

    $cleartext = $crypt->cleartext;

    ?>

This extension requires you to compile PHP with the with-mcrypt flag. See http://php.net/mcrypt for requirements and installation instructions.