I am working on a class for encryption to use on my site. I have read through many examples of these functions and would just like to clarify a few points I have read and check if this code is worthy. It is for storing sensitive information in a database. I am aware that making this method secure does not mean that the information is 100% secure, I simply need an appraisal of the code.
<?php
class Encryption
{
private $eMethod = MCRYPT_RIJNDAEL_128;
private $siteKey = "01234567890123456789012345678901"; # strlen = 32
private $ivSize;
private $iv;
public function __construct()
{
$this->ivSize = mcrypt_get_iv_size( $this->eMethod, MCRYPT_MODE_CBC );
$this->iv = mcrypt_create_iv( $this->ivSize, MCRYPT_RAND );
}
public function encrypt( $data, $salt )
{
$encryptedMessage = mcrypt_encrypt( $this->eMethod, $this->siteKey, $data, MCRYPT_MODE_CBC, $this->iv );
$encryptedSalt = mcrypt_encrypt( $this->eMethod, $this->siteKey, $salt, MCRYPT_MODE_CBC, $this->iv );
$saltIdentifier = str_pad( strlen($encryptedSalt), 6, '0', STR_PAD_LEFT );
$newData = $encryptedSalt.($this->iv).$encryptedMessage.$saltIdentifier;
return($newData);
}
public function decrypt( $data )
{
$thisSaltID = substr( $data, -6 );
$saltID = ltrim($thisSaltID,'0');
$thisSalt = substr( $data, 0, $saltID );
$goTo = $saltID + ($this->ivSize);
$thisIv = substr( $data, $saltID, ($this->ivSize) );
$thisHash = substr( $data, $goTo, -6 );
$decryptedMessage = mcrypt_decrypt( $this->eMethod, $this->siteKey, $thisHash, MCRYPT_MODE_CBC, $thisIv );
return($decryptedMessage);
}
}
?>
When encrypting, it takes the data and a salt, encrypts both and then combines them with the iv and the padded strlen
of the salt as per this line:
$newData = $encryptedSalt.($this->iv).$encryptedMessage.$saltIdentifier;
Then I know which order things appear and can pull it apart accordingly.
Is this salt unnecessary or poorly implemented?
When creating an object and encrypting a string, I pad the string to a length of multiple 16, and generate a random alphanumeric string of length 16 for the salt. Is it unnecessary to make sure the inputs are formatted in this way?
Should the site key be random every time (or static as it is now)? And are there advisements on its length?
Is using
RIJNDAEL_128
with a 256-bit key the equivalent of usingAES-256
?Is this code okay to use?/area of criticism