note 89554 deleted from function.mcrypt-encrypt by googleguy

From: Date: Tue, 22 Oct 2013 08:04:07 +0000
Subject: note 89554 deleted from function.mcrypt-encrypt by googleguy
References: 1  Groups: php.notes 
Request: Send a blank email to php-notes+get-196788@lists.php.net to get a copy of this message
Note Submitter: Kai Sellgren ---- There are a couple of things to remember when encrypting data. 1) For CBC, the IV must be random, but not unique. It also must not be known. 2) For CTR, the IV must be unique and not known, but does not need to be random. 3) The key of the encryption is really important. 4) The random used in the previous example of mine is not that great. The post was a response to earlier post saying "for those that just want some simple encryption/decryption". Use better random functions. MCRYPT_RAND just uses the built-in linear congruential generator, which is poor. 5) You may consider using RIJNDAEL-512 or even -1024. 6) If you want to be able to have NULL bytes in your plaintext, then you should store the plaintext length within the encrypted text to strip out padded NULL bytes.

« previous php.notes (#196788) next »