Ahead of the General Data Protection Regulation (GDPR) I begin to crypt more than ever before, in fact, all I can crypt become crypt.
However, I wonder if anybody can tell me if this code is secure enough or can make it even better, optimize or just have some tips about the code. and not sure about the OpenSSL are secure anymore so if any could give me some feedback about it I will love you forever.
The $key
is defined in the config.php and are a base64 encrypt and look like this e.g bRuD5WYw5wd0rdHR9yLlM6wt2vteuiniQBqE70nAuhU
class myCrypt {
public function my_encrypt($data, $key) {
// Remove the base64 encoding from our key
$encryption_key = base64_decode($key);
// Generate an initialization vector
$iv = openssl_random_pseudo_bytes(openssl_cipher_iv_length('aes-256-cbc'));
// Encrypt the data using AES 256 encryption in CBC mode using our encryption key and initialization vector.
$encrypted = openssl_encrypt($data, 'aes-256-cbc', $encryption_key, 0, $iv);
// The $iv is just as important as the key for decrypting, so save it with our encrypted data using a unique separator (::)
return base64_encode($encrypted . '::' . $iv);
}
public function my_decrypt($data, $key) {
// Remove the base64 encoding from our key
$encryption_key = base64_decode($key);
// To decrypt, split the encrypted data from our IV - our unique separator used was "::"
list($encrypted_data, $iv) = explode('::', base64_decode($data), 2);
return openssl_decrypt($encrypted_data, 'aes-256-cbc', $encryption_key, 0, $iv);
}
}
I like the fact that the same encrypt is never the same, but if a hacker hacks the code will he/she just use the decrypt method to decrypt the data??
PS: This is not for passwords