Re: File encryption under PHP

--=-pUdDusAlWJ5HA+8pkuI6
Content-Type: text/plain
Content-Transfer-Encoding: 7bit

On Thu, 2010-04-01 at 15:47 -0400, Paul M Foster wrote:

> Folks:
>
> If I wanted to encrypt a file in PHP and then write it out to disk
> (one-way encryption, requiring a password), what PHP built-ins might you
> recommend to encrypt the contents of the file before writing it out to
> disk?
>
> Paul
>
> --
> Paul M. Foster
>


I don't think you want one-way encryption, that would mean you can't
unencrypt it!

What about the usual functions for encrypting strings in PHP? Couldn't
you encrypt the file as a string and output that? Or did you want the
file to request a password when it was opened? What about a
password-protected compressed archive file?

Thanks,
Ash
http://www.ashleysheridan.co.uk



--=-pUdDusAlWJ5HA+8pkuI6--

File encryption under PHP

Folks:

If I wanted to encrypt a file in PHP and then write it out to disk
(one-way encryption, requiring a password), what PHP built-ins might you
recommend to encrypt the contents of the file before writing it out to
disk?

Paul

--
Paul M. Foster

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php

Re: File encryption under PHP

On Thu, Apr 01, 2010 at 08:45:53PM +0100, Ashley Sheridan wrote:

> On Thu, 2010-04-01 at 15:47 -0400, Paul M Foster wrote:
>
> Folks:
>
> If I wanted to encrypt a file in PHP and then write it out to disk
> (one-way encryption, requiring a password), what PHP built-ins might you
> recommend to encrypt the contents of the file before writing it out to
> disk?
>
> Paul
>
> --
> Paul M. Foster
>
>
>
> I don't think you want one-way encryption, that would mean you can't unencrypt
> it!

Then "one-way encryption" would be something no one would do. I must be
using the wrong term. What I mean is that it needs a password, which is
used to encrypt and decrypt the file.

>
> What about the usual functions for encrypting strings in PHP? Couldn't you
> encrypt the file as a string and output that? Or did you want the file to
> request a password when it was opened? What about a password-protected
> compressed archive file?

Well, when you say, "usual functions for encrypting strings in PHP",
what are my options there? And which are the best (most secure) methods?
It looks like mcrypt_*() will do the job, but there are 20-30
algorithms, and I have no idea which are the most secure. Or would
something else be better (than mcrypt_*())?

Paul

--
Paul M. Foster

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php

Re: File encryption under PHP

--=-VXN+fxc0Kdmj7vAFRFg/
Content-Type: text/plain
Content-Transfer-Encoding: 7bit

On Thu, 2010-04-01 at 16:04 -0400, Paul M Foster wrote:

> On Thu, Apr 01, 2010 at 08:45:53PM +0100, Ashley Sheridan wrote:
>
> > On Thu, 2010-04-01 at 15:47 -0400, Paul M Foster wrote:
> >
> > Folks:
> >
> > If I wanted to encrypt a file in PHP and then write it out to disk
> > (one-way encryption, requiring a password), what PHP built-ins might you
> > recommend to encrypt the contents of the file before writing it out to
> > disk?
> >
> > Paul
> >
> > --
> > Paul M. Foster
> >
> >
> >
> > I don't think you want one-way encryption, that would mean you can't unencrypt
> > it!
>
> Then "one-way encryption" would be something no one would do. I must be
> using the wrong term. What I mean is that it needs a password, which is
> used to encrypt and decrypt the file.
>
> >
> > What about the usual functions for encrypting strings in PHP? Couldn't you
> > encrypt the file as a string and output that? Or did you want the file to
> > request a password when it was opened? What about a password-protected
> > compressed archive file?
>
> Well, when you say, "usual functions for encrypting strings in PHP",
> what are my options there? And which are the best (most secure) methods?
> It looks like mcrypt_*() will do the job, but there are 20-30
> algorithms, and I have no idea which are the most secure. Or would
> something else be better (than mcrypt_*())?
>
> Paul
>
> --
> Paul M. Foster
>


There's a good reason for one-way encryption. The crypt function in PHP
is one-way, and the use case is to compare an entered password without
the encrypted password ever being unencryptable.

Thanks,
Ash
http://www.ashleysheridan.co.uk



--=-VXN+fxc0Kdmj7vAFRFg/--

Re: File encryption under PHP

On Thu, Apr 1, 2010 at 3:47 PM, Paul M Foster wrote:
> Folks:
>
> If I wanted to encrypt a file in PHP and then write it out to disk
> (one-way encryption, requiring a password), what PHP built-ins might you
> recommend to encrypt the contents of the file before writing it out to
> disk?
>
> Paul
>

I use the MCrypt extension to encrypt strings (login hashes in
cookies, other such things). I don't see why you couldn't read the
file into a string and then use mcrypt. You'd have to play with it
though. Like make sure performance doesn't degrade massively for large
files (rather than small strings), as well as making sure everything
is binary-safe.

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php

Re: File encryption under PHP

On Thu, Apr 1, 2010 at 4:05 PM, Ashley Sheridan
wrote:
> On Thu, 2010-04-01 at 16:04 -0400, Paul M Foster wrote:
>
>> On Thu, Apr 01, 2010 at 08:45:53PM +0100, Ashley Sheridan wrote:
>>
>> > On Thu, 2010-04-01 at 15:47 -0400, Paul M Foster wrote:
>> >
>> >     Folks:
>> >
>> >     If I wanted to encrypt a file in PHP and then write it o=
ut to disk
>> >     (one-way encryption, requiring a password), what PHP bui=
lt-ins might you
>> >     recommend to encrypt the contents of the file before wri=
ting it out to
>> >     disk?
>> >
>> >     Paul
>> >
>> >     --
>> >     Paul M. Foster
>> >
>> >
>> >
>> > I don't think you want one-way encryption, that would mean you can't u=
nencrypt
>> > it!
>>
>> Then "one-way encryption" would be something no one would do. I must be
>> using the wrong term. What I mean is that it needs a password, which is
>> used to encrypt and decrypt the file.
>>
>> >
>> > What about the usual functions for encrypting strings in PHP? Couldn't=
you
>> > encrypt the file as a string and output that? Or did you want the file=
to
>> > request a password when it was opened? What about a password-protected
>> > compressed archive file?
>>
>> Well, when you say, "usual functions for encrypting strings in PHP",
>> what are my options there? And which are the best (most secure) methods?
>> It looks like mcrypt_*() will do the job, but there are 20-30
>> algorithms, and I have no idea which are the most secure. Or would
>> something else be better (than mcrypt_*())?
>>
>> Paul
>>
>> --
>> Paul M. Foster
>>
>
>
> There's a good reason for one-way encryption. The crypt function in PHP
> is one-way, and the use case is to compare an entered password without
> the encrypted password ever being unencryptable.
>
> Thanks,
> Ash

Technically, "one-way encryption" is called hashing, as encryption by
definition is two-way.

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php

Re: File encryption under PHP

Paul M Foster wrote:
> Folks:
>
> If I wanted to encrypt a file in PHP and then write it out to disk
> (one-way encryption, requiring a password), what PHP built-ins might you
> recommend to encrypt the contents of the file before writing it out to
> disk?
>
> Paul

Here's a very generic mcrypt example. IANAE
where security is concerned, but from what I've
read, BLOWFISH should be a fairly decent algorithm
for most applications. This isn't my work, can't
remember whose ... uses 3DES.

KDK


$plaintext = "Four score and seven years ago";
$cipher = MCRYPT_TRIPLEDES;
$mode = MCRYPT_MODE_ECB;
$rand_src = MCRYPT_DEV_RANDOM; //MCRYPT_DEV_RANDOM
$password = 'Extra secret password';

print ("Plaintext: $plaintext\n");

// OK, let's encrypt the data
$handle = mcrypt_module_open ($cipher, '', $mode, '');
if (!$handle)
die ("Couldn't locate open mcrypt module for '$cipher' algorithm");
$iv_size = mcrypt_enc_get_iv_size ($handle);
$ivector = mcrypt_create_iv ($iv_size, $rand_src);
if (mcrypt_generic_init ($handle, $password, $ivector) == -1)
die ("Error: mcrypt_generic_init() failed.");
$ciphertext = mcrypt_generic ($handle, $plaintext);
mcrypt_generic_end ($handle);

echo "
Ciphertext: " . bin2hex ($ciphertext) . "\n";

// Now let's decrypt it
$handle = mcrypt_module_open ($cipher, '', $mode, '');
if (!$handle) die ("Couldn't locate open mcrypt module for '$cipher' algorithm");

if (mcrypt_generic_init ($handle, $password, $ivector) == -1)
die ("Error: mcrypt_generic_init() failed.");
$plaintext = mdecrypt_generic ($handle, $ciphertext);
mcrypt_generic_end ($handle);

echo "
Plaintext: $plaintext\n");
?>

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php

Re: File encryption under PHP

--001517441384e243b50483374dc7
Content-Type: text/plain; charset=ISO-8859-1

>
> Then "one-way encryption" would be something no one would do. I must be using
> the wrong term. What I mean is that it needs a password, which is used to
> encrypt and decrypt the file.


*Symmetric* encryption uses the same key to encrypt and decrypt the text
(what you're talking about, and example algorithms include blowfish, AES.)

*Asymmetric* encryption uses separate keys, allowing anyone to send you an
encrypted message with a public key, but only allowing you to decrypt it
with your private key (https uses this as the initial stage to exchange the
key to be used for the subsequent exchanges of text using symmetric
encryption because symmetric encryption is much faster, and example
algorithm is RSA.)

Adam

--
Nephtali: PHP web framework that functions beautifully
http://nephtaliproject.com

--001517441384e243b50483374dc7--