note 120692 added to filters.encryption

1) The mcrypt module has been deprecated with PHP 7.1. What does that mean for the encryption filters? 2) deriving the IV from the secret passphrase seems wrong. This leaks information about the passphrase without need. 3) using md5() for this? Really? hash() has been available since PHP 5.1.2. 4) hashing the passphrase twice does not add any security. 5) using substr() on binary data (why, oh why, is true passed to md5()?) might lead to headaches if mbstring.func_overload is used. ---- Server IP: 72.52.91.14 Probable Submitter: 213.160.5.140 ---- Manual Page -- http://php.net/manual/en/filters.encryption.php Edit -- https://master.php.net/note/edit/120692 Del: integrated -- https://master.php.net/note/delete/120692/integrated Del: useless -- https://master.php.net/note/delete/120692/useless Del: bad code -- https://master.php.net/note/delete/120692/bad+code Del: spam -- https://master.php.net/note/delete/120692/spam Del: non-english -- https://master.php.net/note/delete/120692/non-english Del: in docs -- https://master.php.net/note/delete/120692/in+docs Del: other reasons-- https://master.php.net/note/delete/120692 Reject -- https://master.php.net/note/reject/120692 Search -- https://master.php.net/manage/user-notes.php