[php-src] Issue #19553: Add streaming encryption/decryption API to OpenSSL extension (openssl_encrypt_init / openssl_encrypt_update /
openssl_encrypt_final)

From: Date: Fri, 22 Aug 2025 09:46:23 +0000
Subject: [php-src] Issue #19553: Add streaming encryption/decryption API to OpenSSL extension (openssl_encrypt_init / openssl_encrypt_update /
openssl_encrypt_final)
Groups: php.bugs 
Request: Send a blank email to php-bugs+get-250599@lists.php.net to get a copy of this message
Issue: https://github.com/php/php-src/issues/19553 Author: degtyaryov ### Description Currently, the OpenSSL extension in PHP provides openssl_encrypt() and openssl_decrypt(), which require the entire data buffer in memory for AES-128-GCM, AES-256-GCM... This makes it impractical to process very large files (e.g. 100 MB, 1 GB, 1 TB) because PHP will try to load the entire content into memory before encrypting/decrypting. **Proposal** Introduce a streaming API for encryption/decryption, similar to how hash_init(), hash_update(), and hash_final() work. For example for encryption: ```php $res = openssl_encrypt_init('aes-256-gcm', $key, OPENSSL_RAW_DATA, $iv, $tag_length); openssl_encrypt_update($ctx, $aad); while (!feof($fp_in)) { $chunk = fread($fp_in, 1048576); // 1 MB $enc = openssl_encrypt_update($res, $chunk); fwrite($fp_out, $enc); } $enc = openssl_encrypt_final($res, $tag); fwrite($fp_out, $enc); ``` And for decryption: ```php $res = openssl_decrypt_init("aes-256-gcm", $key, OPENSSL_RAW_DATA, $iv, $tag); openssl_decrypt_update($ctx, $aad); while (!feof($fp_in)) { $chunk = fread($fp_in, 1048576); $dec = openssl_decrypt_update($res, $chunk); fwrite($fp_out, $dec); } $dec = openssl_decrypt_final($res); fwrite($fp_out, $dec); ```

« previous php.bugs (#250599) next »