More secure defaults for openssl_public_encrypt() & openssl_private_decrypt()
| From: | Sammy Kaye Powers | Date: | Mon, 12 Dec 2016 15:26:05 +0000 |
| Subject: | More secure defaults for openssl_public_encrypt() & openssl_private_decrypt() | ||
| Groups: | php.internals | ||
| Request: | Send a blank email to internals+get-97369@lists.php.net to get a copy of this message | ||
Hey internals!
As pointed out in Paragon's excellent blog post,
openssl_public_encrypt() & openssl_private_decrypt() defaults to the
insecure OPENSSL_PKCS1_PADDING constant.
https://paragonie.com/blog/2016/12/everything-you-know-about-public-key-encryption-in-php-is-wrong#php-openssl-rsa-bad-default
What are your thoughts about deprecating OPENSSL_PKCS1_PADDING and
using OPENSSL_PKCS1_OAEP_PADDING as the new default?
Thanks,
Sammy Kaye Powers
sammyk.me