note 76479 added to function.crypt

ECB is one of the least secure block cipher modes (Wikipedia has some good information about these: http://en.wikipedia.org/wiki/Block_cipher_modes_of_operation) because it is the only mode, out of the one's available for use with MCRYPT, that does not actually use the IV provided. Note: PHP will emit an E_WARNING if the IV is missing or if its length is not equal to the size mandated by mcrypt_get_iv_size(). In response to <addiakogiannis at isds dot gr>, even though the IV is randomly generated in the encryption and decryption functions, the output remains the same given the same plaintext and key because the mode is ECB. If a different mode is used, the IV must be preserved (say, by concatenation with the ciphertext) in order for the ciphertext to be decrypted properly. That is: <?php //changing all instances of MCRYPT_MODE_ECB to MCRYPT_MODE_CFB function RIJNDAEL_encrypt($text){ $iv_size = mcrypt_get_iv_size(MCRYPT_RIJNDAEL_256, MCRYPT_MODE_CFB); $iv = mcrypt_create_iv($iv_size, MCRYPT_RAND); $key = "This is a very secret key"; return base64_encode(mcrypt_encrypt(MCRYPT_RIJNDAEL_256, $key, $text, MCRYPT_MODE_CFB, $iv)); } function RIJNDAEL_decrypt($text){ $iv_size = mcrypt_get_iv_size(MCRYPT_RIJNDAEL_256, MCRYPT_MODE_CFB); $iv = mcrypt_create_iv($iv_size, MCRYPT_RAND); $key = "This is a very secret key"; //I used trim to remove trailing spaces return trim(mcrypt_decrypt(MCRYPT_RIJNDAEL_256, $key, base64_decode($text), MCRYPT_MODE_CFB, $iv)); } //example echo RIJNDAEL_decrypt(RIJNDAEL_encrypt('Her name was lola!')); ?> ...will output a random, 18-character string. Thus, the length of the plaintext is preserved, but the data is completely corrupted. ---- Server IP: 208.69.120.35 Probable Submitter: 72.196.26.193 ---- Manual Page -- http://www.php.net/manual/en/function.crypt.php Edit -- https://master.php.net/note/edit/76479 Del: integrated -- https://master.php.net/note/delete/76479/integrated Del: useless -- https://master.php.net/note/delete/76479/useless Del: bad code -- https://master.php.net/note/delete/76479/bad+code Del: spam -- https://master.php.net/note/delete/76479/spam Del: non-english -- https://master.php.net/note/delete/76479/non-english Del: in docs -- https://master.php.net/note/delete/76479/in+docs Del: other reasons-- https://master.php.net/note/delete/76479 Reject -- https://master.php.net/note/reject/76479 Search -- https://master.php.net/manage/user-notes.php