12 ms·
> MCRYPT_RIJNDAEL_256 I hope you realize this isn't AES-256. I strongly encourage you and anyone else who wants to play with encryption in PHP to just use htt
by some_furry 12y ago
> MCRYPT_RIJNDAEL_256
I hope you realize this isn't AES-256.
I strongly encourage you and anyone else who wants to play with encryption in PHP to just use https://github.com/defuse/php-encryption https://github.com/defuse/php-encryption
Also, encryption isn't authentication. You'll probably quickly hear about Moxie Marlinspike's Cryptographic Doom Principle from others. Basically it means that you should be authenticating your ciphertexts.
Welcome to crypto, a lot can go wrong and some people have very strong opinions about it.
I highly recommend taking the time to go through the challenges on cryptopals.com (by the fine folks at Matasano) and learn more about it. :)
EDIT:
https://github.com/FranciscoP/secretdiary/blob/d5a04a7053597a3d2df0d116efbddd3577aa07af/class.cipher.php#L11 https://github.com/FranciscoP/secretdiary/blob/d5a04a7053597...
In your library, you're using ECB mode, with an IV, and not MACing anything...
- franciscop 12y agoIt was one of my first projects and the first time I did anything with cryptography. I expected it to have some security holes but discontinued it for lack of time, I was just offering the domain here (;
- some_furry 12y agoUnderstood. If you're interested in learning more about crypto I encourage you to check cryptopals out :)
- franciscop 12y agoIt was one of my first projects and the first time I did anything with cryptography. I expected it to have some security holes but discontinued it for lack of time, I was just offering the domain here (;