What is the most secure mcrpyt_encrypt algorithm?

Question

I am trying to come up with a secure algorithm to encrypt and decrypt specific strings in my project I am working on. I am using the mcrypt_encrypt with the MCRYPT_RIJNDAEL_256 block cipher variation.

I have tested many and found this one to seem quite secure.

I am making the encrypt and decrypt into functions so I can call upon them for multiple instances in the future of my project. So far this is what I have come up with. My question here is if there is any way to make this more secure, harder to decrypt or if there are any newer formulas/methods that are known to be better.

function encrypt($privatekey, $stringe)
 {
     $var = mcrypt_encrypt(MCRYPT_RIJNDAEL_256, $privatekey, $stringe, 
 MCRYPT_MODE_CBC, $privatekey);
     return base64_encode($var);
 }
function decrypt($privatekey, $stringd)
{
    $stringd = str_replace("~", "+", $stringd);
    $var = mcrypt_decrypt(MCRYPT_RIJNDAEL_256, $privatekey, 
base64_decode($stringd), MCRYPT_MODE_CBC, $privatekey);
    $var = rtrim($var, "\0\4");
    return $var;
}

mcrypt hasn't been used for years. It's deprecated and doesn't support many more modern padding schemes, block cipher modes, etc. Also note that your code doesn't authenticate the ciphertext and doesn't handle the IV properly. Please see the PHP example in [this repository](https://github.com/luke-park/SecureCompatibleEncryptionExamples) to see a modern and secure example. — Luke Joshua Park, Feb 11 '19 at 06:35
@LukeJoshuaPark thankyou for your response, I had a feeling I was going down the wrong path. I appreciate you getting back to me and I am going to read thoroughly through your reference. — ApexLegend, Feb 11 '19 at 07:12

score 0 · Answer 1 · answered May 29 '19 at 19:05

I have tested many and found this one to seem quite secure.

What tests did you conduct, exactly?

Rijndael256 is a 256-bit block variant of Rijndael (for which the 128-bit block size variant is known as AES). However, when implemented in pure software (like mcrypt is implemented), it's vulnerable to cache-timing attacks.

What is the most secure mcrpyt_encrypt algorithm?

Mcrypt's implementations are not secure. That's why it was deprecated in PHP 7.1, and removed in PHP 7.2.

See this answer for safe-to-use example code backed by libsodium. For PHP 7.1 and below, you want to install the Sodium extension from PECL or install sodium_compat.

What is the most secure mcrpyt_encrypt algorithm?

1 Answers1