note 103943 added to function.mcrypt-encrypt

In the other notes there are some misconceptions about crypto and the IV, especially for CBC mode. The most important point: Encryption DOES NOT provide any proof of data integrity or authentication WHATSOEVER. If you need to be sure that the data is secret and not tampered with, you need to encrypt THEN use a keyed HMAC. For CBC mode, the IV DOES NOT need to be secret. It can be sent along with the plaintext. It needs to be UNIQUE and RANDOM. So that every message is encrypted with a different IV. The best way to generate an IV is to use mcrypt_create_iv(). Keys must be binary, not ASCII. To create a key from a password: <?php $password = "MyPassword!1!"; $aes256Key = hash("SHA256", $password, true); //we want a 32 byte binary blob ?> More: http://ossbox.com/cbcmodeiv.htm ---- Server IP: 216.235.13.26 Probable Submitter: 68.144.23.245 ---- Manual Page -- http://www.php.net/manual/en/function.mcrypt-encrypt.php Edit -- https://master.php.net/note/edit/103943 Del: integrated -- https://master.php.net/note/delete/103943/integrated Del: useless -- https://master.php.net/note/delete/103943/useless Del: bad code -- https://master.php.net/note/delete/103943/bad+code Del: spam -- https://master.php.net/note/delete/103943/spam Del: non-english -- https://master.php.net/note/delete/103943/non-english Del: in docs -- https://master.php.net/note/delete/103943/in+docs Del: other reasons-- https://master.php.net/note/delete/103943 Reject -- https://master.php.net/note/reject/103943 Search -- https://master.php.net/manage/user-notes.php