Encrypt and Decrypt function

This site is best viewed in a modern browser with JavaScript enabled.

wevie

I found this function on the web to encrypt and decrypt passwords and it seems to work pretty well but I don't really understand what is going on with it. Would someone mind explaining it to me please?

function encrypt_decrypt($action, $string){
    $output = false;

$encrypt_method = "AES-256-CBC";
$secret_key = 'This is my secret key';
$secret_iv = 'This is my secret iv';

// hash
$key = hash('sha256', $secret_key);

// iv - encrypt method AES-256-CBC expects 16 bytes - else you will get a warning
$iv = substr(hash('sha256', $secret_iv), 0, 16);

if( $action == 'encrypt' ) {
    $output = openssl_encrypt($string, $encrypt_method, $key, 0, $iv);
    $output = base64_encode($output);
}
else if( $action == 'decrypt' ){
    $output = openssl_decrypt(base64_decode($string), $encrypt_method, $key, 0, $iv);
}

return $output;
}

root

http://www.php.net/manual/en/function.openssl-encrypt.php

Produces a base64 wncoded string

bionoid

May I ask the purpose of the decryption?

If you are sending data between web servers without the use of certificates, then of course the data needs to be decryptable.

But, if you are using this for something like password matching, it would be better to use one-way, salted, hashes instead. PHP and mysql both offer cryptographic functionality for this kind of purpose, such as MD5 or SHA1 etc.

http://php.net/sha1
https://dev.mysql.com/doc/refman/5.5/en/encryption-functions.html

wevie

This is what I wanted to use for password matching.

bionoid

Great, then I would personally suggest using only one-way hashes.

How are your passwords stored? In a file, or in a database?

wevie

They will be stored in a database

bionoid

OK, I will assume you're using MySQL for now.

Let's say you want to create a new user in your [FONT=Courier New]users[/FONT] table, while setting a password:

INSERT INTO users (`username`, `password`) VALUES ("username", SHA1("password"))

And during some login procedure you have on the client side, the webserver could query it like so:

<?php

$username = $_POST['username'];
$password = $_POST['password'];

$rs = mysql_query('SELECT * FROM users u WHERE u.username = "' . mysql_real_escape_string($username) . '" AND u.password = SHA1("' . mysql_real_escape_string($password) . '") LIMIT 1');
if ($user = mysql_fetch_array($rs, MYSQL_ASSOC)) {

	echo 'USER FOUND';
	print_r($user);

} else {

	echo 'USER NOT FOUND';

}
mysql_free_result($rs);

?>

I haven't tested the code, but that's basically how it's done. The passwords are currently unsalted, meaning if users choose the same password they would end up with the same hash.

A recommendation for creating the hash is something like : [FONT=Courier New][password] + [server defined salt] + [unique salt][/FONT]

Eg,

SHA1(CONCAT("password", "server_salt", u.id))

And the same rules would need to be followed on the PHP side as well.