lablnet/php-encryption

Encryption in PHP.

PHP Encryption

Encryption in PHP.

Requirement

1. PHP 7 (7.3 Recommanded).
2. Composer.
3. openSSL php extension.
4. Sodium php extension for use sodium adapter.

Insallation

Installing this package is very simple, first ensure you have the right PHP version and composer installed then in your terminal/(command prompt) run: composer require lablnet/encryption

Encrypt

You can encrypt string by calling to encrypt method

<?php 
use Lablnet\Encryption;
require '../vendor/autoload.php';

$encryption = new Encryption('your-key');

//Encrypt the message
$encrypt = $encryption->encrypt("This is a text");

echo $encrypt;

Decrypt

You can decrypt token by calling decrypt method

<?php 
use Lablnet\Encryption;
require '../vendor/autoload.php';

$encryption = new Encryption('your-key');

//Decrypt the message
$decrypt = $encryption->decrypt($encrypt);	
echo $decrypt;

Adapter

This Package support two encryption adapter

• OpenSSL
• Sodium

Default openSSL will use, you can use any one you want.

change Adapter

You can pass supported adapter to class like

Use of sodium

<?php 
use Lablnet\Encryption;
require '../vendor/autoload.php';

$encryption = new Encryption('your-key','sodium');

Use of openSSL

<?php 
use Lablnet\Encryption;
require '../vendor/autoload.php';

$encryption = new Encryption('your-key','openssl');

Contributions

There is still a lot of work to do, so feel free to contribute to open PR

License

MIT

Support

Donate coffee?
here is the bitcoin address

37x6PA4qtPu2fQnYdW5U7jztYhbchASpBV

Thanks you so much.

Disclaimer

I don't Accept any responsibility for any illegal usage

php-encryption's Issues

Security vulnerability

Hi,

I am trying to test the encryption class, and find that even with a static key, the result changes every single time the script is run.

Also if I paste back into the script an encrypted string then even if the key is changed the string is decrypted..... That cant be right surely, because every single person that runs your class would be able to just decrypt strings without knowing the key?

running this code will replicate the issue

<?php

use Lablnet\Encryption;

require 'vendor/autoload.php';

$encryption = new Encryption('openssl','test');

//Encrypt the message
$encrypt = $encryption->encrypt('some text');
echo strlen(utf8_decode($encrypt)).'<br>';

echo 'Encrypted text: '.$encrypt;
echo "<br\>";

//Decrypt the message
$decrypt = $encryption->decrypt('SWJuRkE1SmxUS0FrRHpacXc0OG9raXl0MUZITnl3T3ZzM2FjcnlYbWViQT0mJmQwMzg3ZjUxYzliNzdmOThmZTRiNjQ0M2E0ODFiMmQ1');
echo '<br> Decrypted/plain text: '.$decrypt;
$decrypt2 = $encryption->decrypt($encrypt);
echo '<br>Decrypted/plain text: '.$decrypt2;

Can you tell me what the encoded string resolves too? Even though the key that encrypted it was not the one in the script?

Posted

Jason Ellmers in phpclasses site form.

The specific key should not have the default value

As title, it seems that the Encryption::__construct has the $key argument and it has the default key value.

I think it's not required because this key is up to the users to specify their key.

The $key always should be the required argument.

We don't have to set the default key because this will cause security problem.

Once someone know the default key from this repo, they will try to do some crack work.