note 114645 added to function.mcrypt-create-iv

In relation to all of the crypto "advice" seen here, my suggestion is that you ignore most of it. Some of it is good, some of it is bad, but most of it skips the critical issues. I had hoped to write out a nice long explanation, but PHP's commenting system tells me my essay is too long. Instead I will say this: You should use CBC, with a randomly chosen IV that is unique per key, and you should transmit that IV in the clear along with your ciphertext. You should also perform an authenticity check of that entire data blob, using something like HMAC-SHA256, with another independent key. Here's the full-text of what I was going to write: http://pastebin.com/sN6buivY If you're interested in this stuff, or just want more information, check out the Wikipedia articles around block cipher modes, block ciphers, HMAC, etc. I also suggest reading Practical Cryptography by Bruce Schneier, as well as Cryptography Engineering by Niels Ferguson, both of which are very easy-to-digest books on practical cryptography. ---- Server IP: 72.52.91.14 Probable Submitter: 82.12.213.153 ---- Manual Page -- http://php.net/manual/en/function.mcrypt-create-iv.php Edit -- https://master.php.net/note/edit/114645 Del: integrated -- https://master.php.net/note/delete/114645/integrated Del: useless -- https://master.php.net/note/delete/114645/useless Del: bad code -- https://master.php.net/note/delete/114645/bad+code Del: spam -- https://master.php.net/note/delete/114645/spam Del: non-english -- https://master.php.net/note/delete/114645/non-english Del: in docs -- https://master.php.net/note/delete/114645/in+docs Del: other reasons-- https://master.php.net/note/delete/114645 Reject -- https://master.php.net/note/reject/114645 Search -- https://master.php.net/manage/user-notes.php