PHP: Mcrypt - which mode?

Question

I've been testing out the various modes available in PHP's mcrypt function. ECB is the mode used in most tutorials, but isn't recommended by both the just linked page and some users, so I reckon that either CBC or CFB should do the trick.

The PHP documentation isn't too fat in it's comparision of the different modes available to mcrypt and instead refers to the book of 'Applied Cryptography by Schneier', which I am not too keen to buy for the moment.

So which of the mcrypt-modes do I want to use and why?

not duplicate but helpful post stackoverflow.com/questions/2809855/… hi kevin ;) — KJYe.Name
– KJYe.Name, Commented Feb 24, 2011 at 17:45
Yeah I know that post, it's my own, but I still miss out any pros/cons of the different modes that available to mcrypt. Why choose CBC over CFC? — Industrial
– Industrial, Commented Feb 24, 2011 at 17:46

aaz · Accepted Answer · 2011-02-25 02:20:23Z

23

mcrypt actually implements more modes than listed, you can use the string names to access them:

cbc – CBC mode
cfb – 8-bit CFB mode;
ncfb – block-size CFB mode;
nofb – OFB mode (not ofb);
ctr – CTR mode.

The modes differ in implementation details, so their suitability depends on your data and environment.

Padding:

CBC mode only encrypts complete blocks, so mcrypt pads your plaintext with zero bytes unless you implement your own padding.
CFB, OFB and CTR modes encrypt messages of any length.

Initialization vector:

CBC and CFB modes require a random IV (don't use MCRYPT_RAND).
OFB mode merely requires a unique IV (e.g. a global counter, maybe the database primary key if rows are never modified or deleted).
CTR requires that each counter block is unique (not just the IV of the message, which is the first counter block, but the rest, formed by incrementing the counter block by 1 for each block of the message).

More information in the NIST recommendations.

There are differences in performance which should be unimportant in PHP, such as whether encryption or decryption can be parallelized and how many cipher iterations are used per block (usually one, but 16 in 8-bit CFB mode).

There are differences in malleability which should be unimportant because you will apply a MAC.

And there may be differences in their security, but for that you should consult a cryptographer.

edited Feb 25, 2011 at 2:20

answered Feb 24, 2011 at 20:02

aaz

5,21424 silver badges18 bronze badges

Sign up to request clarification or add additional context in comments.

5 Comments

Industrial Over a year ago

Thanks for the extensive reply @aaz!

buggedcom Over a year ago

@aaz - you say "(don't use MCRYPT_RAND)" can I ask why?

aaz Over a year ago

@buggedcom – The security of these modes depends on the IV being unpredictable. MCRYPT_RAND uses the PHP random number generator, which may or may not satisfy this requirement. It might be connected to a hardware RNG, or it might return the digits of π. But you can check man 4 random on your system to see that /dev/random is intended for generating cryptographic material, and the default MCRYPT_DEV_RANDOM uses that.

greggles Over a year ago

I know this is an old question/answer, but what about padding with ecb? How does it work?

onin Over a year ago

@greggles You do not need to worry about it, in ECB mode.

Collectives™ on Stack Overflow

PHP: Mcrypt - which mode?

1 Answer 1

5 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

5 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related