PHP: Most secure (decryptable) encryption method?

Question

In PHP, which (decryptable) encryption algorithm is most secure one?
I mean MD5 can't be decrypted back right?
I've found full working class with mcrypt (then encoded with base64 again) which can encrypt and decrypt back.

Sample mcrypt (Encrypt):

function encrypt($value) {
    if(!$value){return false;}
    $text = $value;
    $iv_size = mcrypt_get_iv_size(MCRYPT_RIJNDAEL_256, MCRYPT_MODE_ECB);
    $iv = mcrypt_create_iv($iv_size, MCRYPT_RAND);
    $crypttext = mcrypt_encrypt(MCRYPT_RIJNDAEL_256, $this->key, $text, MCRYPT_MODE_ECB, $iv);
    return trim($this->safe_b64encode($crypttext));
}

Then encode again with base64:

function safe_b64encode($string) {
    $data = base64_encode($string);
    $data = str_replace(array('+','/','='),array('-','_',''),$data);
    return $data;
}

(Sorry for the code just with the encrypt, without decrypt. I just giving sample.) But I just want to know if there other more secure algorithm then using mcrypt.

base64 is NO encryption! It's some sort of encoding. Therefore it is not secure at all. Look for things such as AES (Rijndael), Blowfish, Serpent, Skipjack, etc. in ext/mcrypt for PHP: de2.php.net/manual/en/book.mcrypt.php — Stefan Gehrig
– Stefan Gehrig, Commented Sep 21, 2011 at 10:38
Please narrow your question, because the answer really depends on what for you want encryption. just for clarification: MD5 is not "encryption" - it's "hashing". It's meant to be irreversible. Again, Base64 is not "encryption" - it's "encoding". Please read (wikipedia is enough) a bit on those 3 terms. You should learn that there is no best algorithm - all have their pros and cons. Clarify yourself, please — friendzis
– friendzis, Commented Sep 21, 2011 at 10:39
@Col. Shrapnel What for? @_@ Don't you have to use any encryption in your codes?? — 夏期劇場
– 夏期劇場, Commented Sep 21, 2011 at 11:08

Artjom B. · Accepted Answer · 2014-12-24 10:40:17Z

4

You probably want MCRYPT_RIJNDAEL_256. Rijndael with blocksizes of 128, 192 and 256 bit is a generalization of AES which only supports a blocksize of 128 bit.

See: http://us.php.net/manual/en/mcrypt.ciphers.php and http://us.php.net/manual/en/book.mcrypt.php

edited Dec 24, 2014 at 10:40

Artjom B.

62k26 gold badges137 silver badges236 bronze badges

answered Sep 21, 2011 at 10:36

Ariel

26.8k5 gold badges62 silver badges71 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Tuncay Göncüoğlu · Accepted Answer · 2014-12-24 08:37:28Z

3

Just to clarify: MD and SHA algorithms are HASH algorithms: they calculate a check sum of given data so you can later verify that it hasn't been altered. Think of it like this:

Your data is 592652. You want a checksum to know this hasnt been altered so, you do something like:

5+9+2+6+5+2=29
2+9=11
1+1=2

Now, when you want to check your data, you can put it through same calculation and see if you get the same result:

2

However there is no way to take that 2 and get back your original data: 592652.

Of course real calculations hash algoriths are different, this example is just a demonstration of the general idea. This is not encryption.

As for encryption, AES family of algorithms is probably most secure these days, I'd go AES-512. As others noted RIJNDAEL should be preferred. (AES and Rijndael are used exchangably, theyre almost the same thing: Rijndael is the name of the algorithm while AES is the name of the encryption standard that adops Rijndael as its method).

answered Dec 24, 2014 at 8:37

Tuncay Göncüoğlu

1,80718 silver badges21 bronze badges

1 Comment

Ravinder Payal Over a year ago

Thanks you provided me that thing which i was looking from last 2 years

thwd · Accepted Answer · 2011-09-21 10:57:16Z

1

Base64 is not an encryption algorithm.

On PHP you can use the mcrypt extension to securely encrypt and decrypt data.

Blowfish is one of the most secure (and the default in mcrypt) algorithms supported by PHP.

See the full list of supported algorithms here.

Given that the question changed, this would be the new answer:

mcrypt is not an encryption algorithm. It's a library that provides an interface to different encryption algorithms to encrypt arbitrary data.

In a PHP context this is more or less the only decent thing you have to encrypt data.

edited Sep 21, 2011 at 10:57

answered Sep 21, 2011 at 10:37

thwd

25k8 gold badges79 silver badges110 bronze badges

6 Comments

夏期劇場 Over a year ago

Then, sorry for my stupid questoin :( As you said, mcrypt provides an interface to different encryption algorithms, so which encryption algorithms is actually using in my code?

thwd Over a year ago

MCRYPT_RIJNDAEL_256 <- that one

夏期劇場 Over a year ago

Oh thanks. So please for my native question, does that way is safe? (Or) is there any other safer way? (which can be used as both encrypt/decrypt)

thwd Over a year ago

That algorithm is pretty solid. There is no better or worse but the one you are using is known to be a good one.

夏期劇場 Over a year ago

Thanks for the knowledge Tom. I was asking above question coz you've said Blowfish is most secure. :) ok, thanks anyway dude.

|

Collectives™ on Stack Overflow

PHP: Most secure (decryptable) encryption method?

3 Answers 3

Comments

1 Comment

6 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

1 Comment

6 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related