note 107232 added to function.mcrypt-encrypt

I hope this saves some people some headache. I was implementing a user info cookie encryption routine using mcrypt, but I failed to notice the comment below the function definition on the mcrypt_generic_init() function, which states: You need to call this function before every call to mcrypt_generic() or mdecrypt_generic(). This doesn't seem to be a problem at first, if you are just encrypting individual pieces of information, such as through a function, but if you are doing something complex, such as obfuscating the user information and the initialization vector all being stored in a cookie user_info, then you might run into this problem. (Maybe this warning should be included on mcrypt_generic() and mdecrypt_generic()?) For example-- Encryption: //Initialize encryption module. (replace your_method and your_mode with the appropriate constants. $td = mcrypt_module_open(your_method,'',your_mode,''); //Get key size for encryption method. $ks = mcrypt_enc_get_key_size($td); //Generate key based on security code. (replace hash_method with the appropriate constant) //Also, hash_string needs to be replaced with a string prefereably not just letters. Best to use upper and lower case, numbers, and symbols. $key = substr(bin2hex(mhash(hash_method,hash_string)), 0, $ks); //Create initialization vector. $iv = mcrypt_create_iv(mcrypt_enc_get_iv_size($td), MCRYPT_DEV_RANDOM); //Initialize encryption buffers. mcrypt_generic_init($td, $key, $iv); //Encrypt something. $enc = bin2hex(mcrypt_generic($td, $plaintext1)); //You MUST include this line to reinitialize encryption buffers. mcrypt_generic_init($td, $key, $iv); //Append and encrypt something else. $enc = bin2hex(mcrypt_generic($td, $enc . '|' . $plaintext2)); //Append initialization vector for decryption. $enc = bin2hex($iv) . $enc; //Deinitialize encryption buffers. mcrypt_generic_deinit($td); //Deinitialize encryption module. mcrypt_module_close($td); //At this point, the encrypted user information is in $enc. //You could safely store this in a cookie. Decryption: //Initialize decryption module. (replace your_method and your_mode with the appropriate constants used above) $td = mcrypt_module_open(your_method,'',your_mode,''); //Get key size for decryption method. $ks = mcrypt_enc_get_key_size($td); //Generate key based on security code. (replace hash_method with the appropriate constant used above) //Also, hash_string needs to be replaced with the same string used when encrypting. $key = substr(bin2hex(mhash(hash_method,hash_string)), 0, $ks); //Retrieve initialization vector for decryption. $iv = pack("H*", substr($enc,0,mcrypt_enc_get_iv_size($td)*2)); //Initialize decryption buffers. mcrypt_generic_init($td, $key, $iv); //Split and decrypt $plaintext2 from above. $enc = mdecrypt_generic($td, pack("H*", substr($enc, mcrypt_enc_get_iv_size($td)*2))); //Split off $plaintext2. $plaintext2 = trim(substr($enc,strpos($enc, "|")+1)); //You MUST include this line to reinitialize decryption buffers. mcrypt_generic_init($td, $key, $iv); //Split and decrypt $plaintext1. $enc = mdecrypt_generic($td, pack("H*", substr($enc, 0, strpos($enc, "|")))); //Split off $plaintext1. $plaintext1 = trim(substr($enc,strpos($enc, "|")+1)); //You MUST include this line to reinitialize decryption buffers. mcrypt_generic_init($td, $key, $iv); //Deinitialize decryption buffers. mcrypt_generic_deinit($td); //Deinitialize decryption module. mcrypt_module_close($td); //At this point, $plaintext1 and $plaintext2 hold their original values. //You should still verify the data types and verify the information before continuing, just in case someone were to hack your scheme, however unlikely. ---- Server IP: 69.147.83.197 Probable Submitter: 162.39.212.101 ---- Manual Page -- http://www.php.net/manual/en/function.mcrypt-encrypt.php Edit -- https://master.php.net/note/edit/107232 Del: integrated -- https://master.php.net/note/delete/107232/integrated Del: useless -- https://master.php.net/note/delete/107232/useless Del: bad code -- https://master.php.net/note/delete/107232/bad+code Del: spam -- https://master.php.net/note/delete/107232/spam Del: non-english -- https://master.php.net/note/delete/107232/non-english Del: in docs -- https://master.php.net/note/delete/107232/in+docs Del: other reasons-- https://master.php.net/note/delete/107232 Reject -- https://master.php.net/note/reject/107232 Search -- https://master.php.net/manage/user-notes.php