Php session wrapper class

Question

 class session{
//variabile folosite
private static $_sessionStarted = false;
private static $_crypt  = 'qwerty347658@$%AdfSV045*&erT2Erb%6w!07&[.?;ru';
private static $_salt   = 'qwertyAF347658@$%AdfSV045*&erTyUsdfYtrLmncBGhu';
private static $_rand   = 'abcdefghijklmnoqprstuvxwz0123456789!@#$%^&*()_-=;:<>,.';
private static $_rand_pass;
//pornire sesiune, setari(http only, folosire cookie,generare pass random, modificare folder sesiuni)
public static function start(){
    ini_set('session.cookie_httponly',1);
    ini_set('session.use_only_cookies',1);
    session_save_path(SESS_PATH);
    ini_set('session.gc_probability', 2);
    ini_set('session.gc_divisor', 100);
    ini_set('session.gc_maxlifetime', 1440); 
    if(self::$_sessionStarted == false){
        session_start();
        self::$_sessionStarted = true;
        self::rand_pass(self::$_rand);
        self::set('bad_ideea:D', self::$_rand_pass);
    }
    session_regenerate_id(true);
}
//sesion destroy, stergem toate sesiunile
public static function stop(){
    if(self::$_sessionStarted == true){
        foreach($_SESSION as $k){
        unset($_SESSION[$k]);
        }
        session_destroy();
    }      
}
//setare sesiuni, folosim array asociativ multidimensional
public static function set($key, $value){
    $_SESSION[$key] = $value;
}
//setare array associtiv doar criptat folosind aes 128 biti(pt informatii confidentiale)
public static function set_e($key, $value){
    $_SESSION[$key] = self::encrypt($value);
}
// returnam valoare aaray asociativ multidimensional
public static function get($key, $secondKey = false){
    if($secondKey == true){
        if(isset($_SESSION[$key][$secondKey])){
            return $_SESSION[$key][$secondKey];
        }
    }else{
        if(isset($_SESSION[$key])){
            return $_SESSION[$key];
        }
    }

    return false;
}
//returnam valoare decriptata array asociativ
public static function get_e($key, $secondKey = false){
        if(isset($_SESSION[$key])){
            return self::decrypt($_SESSION[$key]);
        }
    return false;
}
//verificam existenta cheii in array si verificam daca valoarea corespunde
public static function check($key, $val){
    foreach($key as $k){
        if(!array_key_exists($k, $_SESSION) || $_SESSION[$k] != array_shift($val)){
            return false;
        }
    }
    return true;
}
  //facem unset la sesiuni parametru string sau array
public static function clean($key){
    if(is_array($key)){
        foreach($key as $k){
            unset($k);
        }
    }else{
        unset($key);
    }
}
//hash ripemd320 pt valori importante la care avem nevoie doar de comparare(browser os ip etc)
public static function sess_hash($key){
    return hash('ripemd320', $key.self::$_crypt);
}
//generare parola aleatoare pt criptare si stocare in $_rand_pass
private static function rand_pass(){
    for($i = 0; $i <= 20; $i++){
            $tmp[] =  self::$_rand[rand(0, strlen(self::$_rand)-1)];
    }
    self::$_rand_pass = implode('',$tmp);
}
//criptare
private static function encrypt($decrypted) {
    $key = hash('SHA256', self::$_salt . self::$_rand_pass, true);
    srand();
    $iv = mcrypt_create_iv(mcrypt_get_iv_size(MCRYPT_RIJNDAEL_128, MCRYPT_MODE_CBC), MCRYPT_RAND);
    if (strlen($iv_base64 = rtrim(base64_encode($iv), '=')) != 22) return false;
    $encrypted = base64_encode(mcrypt_encrypt(MCRYPT_RIJNDAEL_128, $key, $decrypted . md5($decrypted), MCRYPT_MODE_CBC, $iv));

    return $iv_base64 . $encrypted;
}
//decriptare
private static function decrypt($encrypted) {
    $key = hash('SHA256', self::$_salt . self::$_rand_pass, true);
    $iv = base64_decode(substr($encrypted, 0, 22) . '==');
    $encrypted = substr($encrypted, 22);
    $decrypted = rtrim(mcrypt_decrypt(MCRYPT_RIJNDAEL_128, $key, base64_decode($encrypted), MCRYPT_MODE_CBC, $iv), "\0\4");
    $hash = substr($decrypted, -32);
    $decrypted = substr($decrypted, 0, -32);
    if (md5($decrypted) != $hash) return false;

    return $decrypted;
}
//afisam arrayul $_SESSION pt debug
 public static function display(){
    echo '<pre>';
    print_r($_SESSION);
    echo '</pre>';
}

I wrote a small session wrapper class. Is it good for something? For now I'm still trying to figure out where to store the encryption key. I guess MySQL is the best place to save it. I'm going to regenerate the key every 6-12 hours for each user.

Answer 1

1. You said in a comment that you're storing half of the encryption key alongside the data the data you're encrypting, and the other half in the code itself. What's the point of that? If they have access to the PHP files, they probably have access to the session files, too.

2. There's basically no point in calling srand() with no arguments. It doesn't make its output "more random". Relevant

3. The issue with calling session_regenerate_id with every page load is that if you have two pages loading from the same user at the same time, the user will get logged out.

Here's an example:

1. User sends "GET /page1" and "Cookie: session=cookie1"
2. User sends "GET /page2" and "Cookie: session=cookie1"
3. Server receives request for page1; Server changes cookie, sends back "Set-Cookie: session=cookie2".
4. User receives new cookie and saves it, but it is too late.
5. Server receives request for page2; since cookie1 != cookie2, the request fails and the user is redirected to the login page.