How to remove PHP Randomization encryption

Asked

Viewed 66 times

0

I have a code but every time when updating the page it generates a random encryption key, I would like to know how to leave it to generate a unique key for each url, below follows the code:

$gKey = 'welcometoapicodesdotcomthisiskey';
function decode($pData)
{
    global $gKey;
    $lData = str_replace(' ','+', $pData);
    $lBase64Decoded_Payload = base64_decode($lData);
    $lEncrypted_PlainText = substr($lBase64Decoded_Payload, 16);
    $lIV = substr($lBase64Decoded_Payload, 0, 16);
    $lDecrypted_PlainText = mcrypt_decrypt(MCRYPT_RIJNDAEL_128, $gKey, $lEncrypted_PlainText, MCRYPT_MODE_CBC, $lIV);
    $lBase64Decoded_PlainText = base64_decode($lDecrypted_PlainText);
    return $lBase64Decoded_PlainText;
}

function encode($pData)
{
    global $gKey;
    $lBase64Encoded_PlainText = base64_encode($pData);
    $lIV = GenerateIV();
    $lEncrypted_PlainText = mcrypt_encrypt(MCRYPT_RIJNDAEL_128, $gKey, $lBase64Encoded_PlainText, MCRYPT_MODE_CBC, $lIV);
    $lPayload = $lIV.$lEncrypted_PlainText;
    $lBase64Encoded_Payload = base64_encode($lPayload);
    return $lBase64Encoded_Payload;
}

function GenerateIV()
{
    $lIV = mcrypt_create_iv(16, MCRYPT_DEV_URANDOM);
    while(strlen($lIV) < 16)
    {
        $lIV .= "\0";
    }
    return $lIV;
}

php html cryptography link encode

1 answer

0

The encryption key is fixed on your code, it is exactly what is set in:

$gKey = 'welcometoapicodesdotcomthisiskey';

With this key you can encrypt and decrypt the texts, as well as anyone else who knows (or discovers) this key.

What happens is that the ciphers need a unique value, Nonce. In the case of the CBC method it is called IV (which is the first block), and it must be unique and still random. IV is a public datum, so anyone can have access to it, including it is concatenated at the beginning ($lIV.$lEncrypted_PlainText;).

What is generated "every time you update the page" is IV, this behavior is right.

It is possible to generate unique but deterministic IR, but this is not generally recommended, but it can be done using some KDF, but I don’t take any chances and give some suggestion. In addition, the mcrypt_* is already considered obsolete, so I don’t think it’s worth using this.

Browser other questions tagged php html cryptography link encode

You are not signed in. Login or sign up in order to post.