php - PHP中的双向加密

Question

我的应用程序(显然)使用唯一 ID 来区分记录。此 UID 在 URL 中传递(例如 ./examplepage.php?UID=$example_int)等等。

虽然我显然有服务器端验证以确保客户端不会访问其他客户端的数据，但我是否可以在 PHP 中使用双向加密方法来仅传递加密的 UID(例如 ./examplepage.php?EUID=$encrypted_int)，以进一步减少任何人想“嘿，如果我增加这个整数会发生什么？”的机会

TIA。

Answer 1

PHP 5.3 引入了一种真正易于使用的新加密方法:openssl_encrypt 和openssl_decrypt。这里没有很好的记录，所以这里有一个简单的例子:

$textToEncrypt = "My super secret information.";
$encryptionMethod = "AES-256-CBC";  // AES is used by the U.S. gov't to encrypt top secret documents.
$secretHash = "25c6c7ff35b9979b151f2136cd13b0ff";

//To encrypt
$encryptedMessage = openssl_encrypt($textToEncrypt, $encryptionMethod, $secretHash);

//To Decrypt
$decryptedMessage = openssl_decrypt($encryptedMessage, $encryptionMethod, $secretHash);

//Result
echo "Encrypted: $encryptedMessage <br>Decrypted: $decryptedMessage";

我选择 256-AES 是因为它可靠且速度快。美国政府已采用它来加密绝密文件。考虑机器和软件的速度很快。以下是可用加密方法的列表:

AES-128-CBC、AES-128-CFB、AES-128-CFB1、AES-128-CFB8、AES-128-ECB、AES-128-OFB、AES-192-CBC、AES-192-CFB , AES-192-CFB1, AES-192-CFB8, AES-192-ECB, AES-192-OFB, AES-256-CBC, AES-256-CFB, AES-256-CFB1, AES-256-CFB8, AES -256-ECB, AES-256-OFB, BF-CBC, BF-CFB, BF-ECB, BF-OFB, CAMELLIA-128-CBC, CAMELLIA-128-CFB, CAMELLIA-128-CFB1, CAMELLIA-128-CFB8 , CAMELLIA-128-ECB, CAMELLIA-128-OFB, CAMELLIA-192-CBC, CAMELLIA-192-CFB, CAMELLIA-192-CFB1, CAMELLIA-192-CFB8, CAMELLIA-192-ECB, CAMELLIA-192-OFB, CAMELLIA -256-CBC、CAMELLIA-256-CFB、CAMELLIA-256-CFB1、CAMELLIA-256-CFB8、CAMELLIA-256-ECB、CAMELLIA-256-OFB、CAST5-CBC、CAST5-CFB、CAST5-ECB、CAST5-OFB , DES-CBC, DES-CFB, DES-CFB1, DES-CFB8, DES-ECB, DES-EDE, DES-EDE-CBC, DES-EDE-CFB, DES-EDE-OFB, DES-EDE3, DES-EDE3 -CBC、DES-EDE3-CFB、DES-EDE3-CFB1、DES-EDE3-CFB8、DES-EDE3-OFB、DES-OFB、DESX-CBC、RC2-40-CBC、RC2-64-CBC、RC2-CBC , RC2-CFB, RC2-ECB, RC2-OFB, RC4, RC4-40, SEED-CBC, SEED-CFB, SEED-ECB, SEED-OFB, aes-128-cbc, aes-128-cfb, aes-128 -cfb1, ae s-128-cfb8, aes-128-ecb, aes-128-ofb, aes-192-cbc, aes-192-cfb, aes-192-cfb1, aes-192-cfb8, aes-192-ecb, aes- 192-ofb, aes-256-cbc, aes-256-cfb, aes-256-cfb1, aes-256-cfb8, aes-256-ecb, aes-256-ofb, bf-cbc, bf-cfb, bf- ecb，bf-ofb，camellia-128-cbc，camellia-128-cfb，camellia-128-cfb1，camellia-128-cfb8，camellia-128-ecb，camellia-128-ofb，camellia-192-cbc，camellia- 192-cfb，camellia-192-cfb1，camellia-192-cfb8，camellia-192-ecb，camellia-192-ofb，camellia-256-cbc，camellia-256-cfb，camellia-256-cfb1，camellia-256- cfb8, camellia-256-ecb, camellia-256-ofb, cast5-cbc, cast5-cfb, cast5-ecb, cast5-ofb, des-cbc, des-cfb, des-cfb1, des-cfb8, des-ecb, des-ede, des-ede-cbc, des-ede-cfb, des-ede-ofb, des-ede3, des-ede3-cbc, des-ede3-cfb, des-ede3-cfb1, des-ede3-cfb8, des-ede3-ofb, des-ofb, desx-cbc, rc2-40-cbc, rc2-64-cbc, rc2-cbc, rc2-cfb, rc2-ecb, rc2-ofb, rc4, rc4-40, 种子- cbc, seed-cfb, seed-ecb, seed-ofb

---

重要更新!!!

感谢 Hobo 和 Jorwin 指出在 PHP 5.3.3 中 > 有一个新参数使这个函数更安全一些。

Jorwin 在 his comment 中引用了此链接, 以下是适用的摘录:

In 5.3.3 they added a new parameter, string $iv (initialization vector) Real parameters are: string openssl_encrypt ( string $data ,
string $method , string $password, bool $raw_output = false, string
$iv )

If $iv is missing, a warning is issued: "Using an empty Initialization Vector (iv) is potentially insecure and not recommended".

If $iv is too short, another warning: "IV passed is only 3 bytes long, cipher expects an IV of precisely 8 bytes, padding with \0"

same IV should be used in openssl_decrypt()