note 117667 added to function.mcrypt-encrypt

If you're writing code to encrypt/encrypt data in 2015, you should use openssl_encrypt() and openssl_decrypt(). The underlying library (libmcrypt) has been abandoned since 2007, and performs far worse than OpenSSL (which leverages AES-NI on modern processors and is cache-timing safe). Also, MCRYPT_RIJNDAEL_256 is not AES-256, it's a different variant of the Rijndael block cipher. If you want AES-256 in mcrypt, you have to use MCRYPT_RIJNDAEL_128 with a 32-byte key. OpenSSL makes it more obvious which mode you are using (i.e. 'aes-128-cbc' vs 'aes-256-ctr'). OpenSSL also uses PKCS7 padding with CBC mode rather than mcrypt's NULL byte padding. Thus, mcrypt is more likely to make your code vulnerable to padding oracle attacks than OpenSSL. Finally, if you are not authenticating your ciphertexts (Encrypt Then MAC), you're doing it wrong. Further reading: https://paragonie.com/blog/2015/05/using-encryption-and-authentication-correctly https://paragonie.com/blog/2015/05/if-you-re-typing-word-mcrypt-into-your-code-you-re-doing-it-wrong ---- Server IP: 72.52.91.14 Probable Submitter: 71.47.14.165 ---- Manual Page -- http://php.net/manual/en/function.mcrypt-encrypt.php Edit -- https://master.php.net/note/edit/117667 Del: integrated -- https://master.php.net/note/delete/117667/integrated Del: useless -- https://master.php.net/note/delete/117667/useless Del: bad code -- https://master.php.net/note/delete/117667/bad+code Del: spam -- https://master.php.net/note/delete/117667/spam Del: non-english -- https://master.php.net/note/delete/117667/non-english Del: in docs -- https://master.php.net/note/delete/117667/in+docs Del: other reasons-- https://master.php.net/note/delete/117667 Reject -- https://master.php.net/note/reject/117667 Search -- https://master.php.net/manage/user-notes.php