note 103943 modified in function.mcrypt-encrypt by danbrown

In the other notes there are some misconceptions about crypto and the IV, especially for CBC mode. The most important point: Encryption DOES NOT provide any proof of data integrity or authentication WHATSOEVER. If you need to be sure that the data is secret and not tampered with, you need to encrypt THEN use a keyed HMAC. For CBC mode, the IV DOES NOT need to be secret. It can be sent along with the plaintext. It needs to be UNIQUE and RANDOM. So that every message is encrypted with a different IV. The best way to generate an IV is to use mcrypt_create_iv(). Keys must be binary, not ASCII. To create a key from a password: <?php $password = "MyPassword!1!"; $aes256Key = hash("SHA256", $password, true); //we want a 32 byte binary blob ?> --was-- In the other notes there are some misconceptions about crypto and the IV, especially for CBC mode. The most important point: Encryption DOES NOT provide any proof of data integrity or authentication WHATSOEVER. If you need to be sure that the data is secret and not tampered with, you need to encrypt THEN use a keyed HMAC. For CBC mode, the IV DOES NOT need to be secret. It can be sent along with the plaintext. It needs to be UNIQUE and RANDOM. So that every message is encrypted with a different IV. The best way to generate an IV is to use mcrypt_create_iv(). Keys must be binary, not ASCII. To create a key from a password: <?php $password = "MyPassword!1!"; $aes256Key = hash("SHA256", $password, true); //we want a 32 byte binary blob ?> More: http://ossbox.com/cbcmodeiv.htm http://php.net/manual/en/function.mcrypt-encrypt.php