Databases
StackOverflow2013
Postsdbo
POReplace Mcrypt with OpenSSL
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POReplace Mcrypt with OpenSSL
    primarykey
    data
    text
    <p>currently we have a mcrypt implentation on our systems to crypt some sensible data in our PHP application. Now we have a new requirement that we have to change the crypt module to openssl. Another thing which is important know is that we are using the cipher blowfish and the mode ecb. So I began to test what are differences and how I can decrypt mcrypt encrypted strings with openssl.</p> <p>I used the standard PHP function: </p> <ul> <li>mcrypt_encrypt vs. openssl_encrypt</li> <li>mcrypt_decrypt vs. openssl_decrypt</li> </ul> <p>Both methods are delivering different results. Second thing is that in the given cipher (blowfish) and mode (ecb) in both types different IV lengthes are required (openssl=0 and mcrypt=56).</p> <p>Does anybody know how I can easily change the modules without having a big migration effort?</p> <p>Thanks in advance!</p> <p>UPDATE:</p> <p>Here is the code, which I tested it:</p> <pre><code>&lt;?php function say($message){ if(!is_string($message)){ if(!isset($_SERVER["HTTP_USER_AGENT"])) echo "&lt;pre&gt;"; echo var_export($message, true) . ((!isset($_SERVER["HTTP_USER_AGENT"]) ? "\n" : "&lt;br /&gt;")); if(!isset($_SERVER["HTTP_USER_AGENT"])) echo "&lt;/pre&gt;"; }else{ echo $message . ((!isset($_SERVER["HTTP_USER_AGENT"]) ? "\n" : "&lt;br /&gt;")); } } say("= Begin raw encryption"); $key = "anotherpass"; $str = "does it work"; say(" Params:"); say(" - String to encrypt '".$str."'"); say(" - Key: ".$key); say(""); $params = array( "openssl" =&gt; array( "cipher" =&gt; "BF", "mode" =&gt; "ECB", ), "mcrypt" =&gt; array( "cipher" =&gt; "blowfish", "mode" =&gt; "ecb", ), ); say("= Mcrypt"); $handler = mcrypt_module_open($params['mcrypt']['cipher'], '', $params['mcrypt']['mode'], ''); $iv = mcrypt_create_iv (mcrypt_enc_get_iv_size($handler), MCRYPT_RAND); $keysize = mcrypt_enc_get_key_size($handler); mcrypt_generic_init($handler,$key,"\0\0\0\0\0\0\0\0"); say(" Params:"); say(" - InitVector ".bin2hex($iv)." (bin2hex)"); say(" - Max keysize ".$keysize); say(" - Cipher ".$params['mcrypt']['cipher']); say(" - Mode ".$params['mcrypt']['mode']); say(""); say(" Encryption:"); $m_encrypted = mcrypt_generic($handler, $str); $m_decrypted = mdecrypt_generic($handler, $m_encrypted); say(" - Encrypted ".bin2hex($m_encrypted)." (bin2hex)"); say(" - Descrypted ".$m_decrypted); say(""); say("= Openssl"); say(" Params:"); say(" - InitVector not needed"); say(" - Max keysize ".openssl_cipher_iv_length($params['openssl']['cipher']."-".$params['openssl']['mode'])); say(" - Cipher ".$params['openssl']['cipher']); say(" - Mode ".$params['openssl']['mode']); say(""); say(" Encryption:"); $o_encrypted = openssl_encrypt($str,$params['openssl']['cipher']."-".$params['openssl']['mode'],$key,true); $o_decrypted = openssl_decrypt($o_encrypted,$params['openssl']['cipher']."-".$params['openssl']['mode'],$key,true); say(" - Encrypted ".bin2hex($o_encrypted)." (bin2hex)"); say(" - Descrypted ".$o_decrypted); </code></pre> <p>And this is my result:</p> <pre><code>= Begin raw encryption Params: - String to encrypt 'does it work' - Key: anotherpass = Mcrypt Params: - InitVector 06a184909d7bf863 (bin2hex) - Max keysize 56 - Cipher blowfish - Mode ecb Encryption: - Encrypted 0e93dce9a6a88e343fe5f90d1307684c (bin2hex) - Descrypted does it work = Openssl Params: - InitVector not needed - Max keysize 0 - Cipher BF - Mode ECB Encryption: - Encrypted 213460aade8f9c14d8d51947b8231439 (bin2hex) - Descrypted does it work </code></pre> <p>Maybe any ideas now?</p> <p>Thanks!</p>
    singulars
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. PTQuestion
    1. USjww
    1. USmaTu
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. PO
      singulars
      1. PTAnswer
    1. VO
      singulars
      1. POReplace Mcrypt with OpenSSL
      1. This table or related slice is empty.
      1. VTUpMod
    2. VO
      singulars
      1. POReplace Mcrypt with OpenSSL
      1. This table or related slice is empty.
      1. VTUpMod
    3. VO
      singulars
      1. POReplace Mcrypt with OpenSSL
      1. USovershadow
      1. VTFavorite
    1. COYou'll either have to run a migration script that decrypts the current data using mcrypt and then encrypts it again using openssl, or else you'll need to implement a method by which you know which encryption/decryption functions to use for each item of data, and change them from mcrypt to openssl as required when next accessing some data encrypted using mcrypt.
      singulars
      1. POReplace Mcrypt with OpenSSL
      1. USJon
    2. COAs I understand it, mcrypt and open_ssl use different key derivation methods and so Jon is right, you will need to either migrate by decrypt then encrypt or mark data so that it gets migrated as it is next accessed.
      singulars
      1. POReplace Mcrypt with OpenSSL
      1. USReid Johnson
    3. COI wonder why IB is required in ECB mode. See the description of ECB mode at http://en.wikipedia.org/wiki/Block_cipher_modes_of_operation.
      singulars
      1. POReplace Mcrypt with OpenSSL
      1. USdoptimusprime
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload