4 ms·
Aye. I think cryptography escapes most developers. Especially most PHP developers. I've been talking in #php.security on Freenode with ircmaxell and a few othe
by sarciszewski 11y ago
Aye. I think cryptography escapes most developers. Especially most PHP developers.
I've been talking in #php.security on Freenode with ircmaxell and a few others about making a pluggable high-level PHP library that abstracts all the lego blocks away and just gives a sane interface. (Note: This is mostly ircmaxell's idea, I just offered a draft for the API layout.)
For example:
$c = new \Crypto\Symmetric('openssl:cipher=aes-128;mode=cbc;hash=sha256');
$k = $c->generateKey();
$cipher = $c->encrypt("Some message", $k);
Omitting any of these parameters (e.g. just passing 'openssl:') should have sane, opinionated defaults that prioritize security. Developers will NOT be allowed to use ECB mode.
The idea is that it should support multiple "drivers" (openssl, libsodium, possibly a begrudging mcrypt inclusion).
PDO : databases :: this idea : cryptography
The roadmap looks like this:
1. a PHP implementation/PoC
2. a PECL extension
3. a RFC and pull request to make it part of the PHP 7.1 core
We already have password_hash() and password_verify(), there's no reason we can't abstract a typical use-case away from the average PHP developer and prevent them from implementing it themselves, horribly.