PHP - Personal Encryption

Hi Guys,   First off, not sure if this is the correct area to post. My question is a little bit mixed, including SQL and PHP.   I'm building a basic private messaging system, and planned to use PHP, SQL for the storage, and a little bit of JS on the client. I'm a little confused when it comes to encryption though. My understanding with user password encryption is that the password is stored in the database as a hash, and then a user sent password is compared to the original hash for verification. I've implemented this successfully using password_verify() and password_hash() functions, and I'm pretty sure it's working fine.   However, my big question is in regards to the storage of message data. As far as I can tell, this system won't work, it's really only suitable for password verification because the hash can't really be reverted to the original data, it can only be compared? How should I go about encrypting message data? Is it possible? If I open up a SQL database containing private message data on a server, I don't want to be able to read the contents.   Any help would be greatly appreciated!

I seen the sticky but that didn't have my answer and no place I go is really answering my core question. This just doesn't make sense in my brain, how is using md5 safe. What if someone got say an encrypted pass. The code md5 uses is available to anyone, no? So if they got a hold of it how is it not as easily cracked as it is encrypted. Someone please explain this to me lol, it's like a thorn in my brain.

Hello, recently I changed host of my website and when a visitor clicks "contact us" button in my website (in which one needs to enter his/ her email, name, phone , etc) and submit his/her message then I get email. Before this hosting I used to get emails from the visitor who filled the form so it was easier for me to reply but now after I changed the host I get email as "mydomain@hosting-company-domain" instead of the visitor's email. I messaged them then they told me something about SMTP authenticate using PHP, please guide me to fix this.

Hy 2 all,

I have some questions about password security that I haven't been able to find an answer yet.   
Hopefully you guys know.

Here it goes:

1. Is it better to hash(sha2) the password and then salt it or salt it and than hash it ?
2. I'm guessing that using a random salt is better than the same salt used for every password.
3. How can you generate a different random salt for each password ? I mean how will the login page know which random salt to mix with the hashed user inserted password and then to compare it with the password stored in the db. (an example would be great(for both: generating and authentication)
4. I saw some codes in which the salt and/or hash and/or password was split into two (ex: hash.salt1a.password.salt1b  or  password1a.salt.password1b  or  salt.hash1a.password.hash1b  etc.) Is this a good idea ? Is it really more secure ? If so which would be more secure (splitting the password, the hash or the salt) ?
5. Is double hashing (ex: (sha1(md5($password))) any good ?
6. I've been reading something about password salt and pepper ?? What exactly is pepper ? Is it some sort of second salt ?

If somebody could enlighten me about these questions, that would be great.

Thanks in advance!

I am looking for a way to encrypt a string using PKCS7. I have seen openssl_pkcs7_encrypt() but this involves the creation of temporary files which I don't really need. Is there a way to do this?

I would like to add md5 encryption into the create and login functions but I'm having difficulties with the process.

user.php - create user and login functions
Code: [Select]
<?php
function create_user($params)
{
 db_connect_posts();
 $query = sprintf("INSERT INTO users 
SET
users.screen_name = '%s',
users.user_email = '%s',
users.user_pwd = '%s',
users.image = '%s',
created_at = NOW()"
, mysql_real_escape_string($params['screen_name']),
mysql_real_escape_string($params['user_email']),
mysql_real_escape_string($params['user_pwd']),
mysql_real_escape_string($params['image'])
);
 $result = mysql_query($query);
 if(!$result)
 {
return false;
 }
 else
 {
return true;
 }
}

function login($username, $password)
{
 db_connect_posts();
 $query = sprintf("SELECT * FROM users
WHERE 
user_email = '%s' AND
user_pwd = '%s'"
, mysql_real_escape_string($username),
mysql_real_escape_string($password)
);
 $result = mysql_query($query);
 $number_of_posts = mysql_num_rows($result);
 if($number_of_posts == 0)
 {
return false;
 }

 $row = mysql_fetch_array($result);

 $_SESSION['user'] = $row;

 return true;
}
?>
Register form:
Code: [Select]
<form action="<?php echo '/'.APP_ROOT.'/'; ?>sessions/signup" method="post">
  <fieldset>
    <legend>Register</legend>
    <div>
      <label>Screen Name</label>
      <input name="user[screen_name]" size="40" type="text" />
    </div>
   
    <div>
      <label>E-mail</label>
      <input name="user[user_email]" size="40" type="text" />
    </div>
   
    <div>
      <label>Password</label>
      <input name="user[user_pwd]" size="40" type="password" />
    </div>
   
    <div>
      <label>Image</label>
      <input name="user[image]" size="40" type="text" />
    </div>
    <input type="submit" name="Register" value="Register" />
  </fieldset>
</form>
Login form:
Code: [Select]
<form action="<?php echo '/'.APP_ROOT.'/'; ?>sessions/login_user" method="post">
  <fieldset>
    <legend>Login</legend>
    <div>
      <label>E-mail</label>
      <input name="user[user_email]" size="40" type="text" />
    </div>
   
    <div>
      <label>Password</label>
      <input name="user[user_pwd]" size="40" type="password" />
    </div>
    <input type="submit" value="Login" />
  </fieldset>
</form>

Hey, I'm a bit stuck. I'm looking for a simple yet secure way to encrypt a string (not hash, I need to retrieve it later) so that I can store legally sensitive data which I need to use again later. I am aware that any kind of reversable data is by nature not properly secure, but it's not my decision. I'd rather see if there's a pre-built function or class for this rather than just writing my own, which wouldn't be too good

Thanks in Advance
Gareth

Is there any tutorial or book where i can learn about how to do the encryption?? thanks in advance

I have never worked with des encryption before and have searched through internet getting 3 des and acb - tested multiple code but cant get encrypted the same as in c#

 

public string EncryptQueryString(string stringToEncrypt)

 

public string EncryptQueryString(string stringToEncrypt)
        {
            byte[] key = { };
            byte[] IV = { 0x01, 0x12, 0x23, 0x34, 0x45, 0x56, 0x67, 0x78 };
            try
            {
                key = Encoding.UTF8.GetBytes(KEY);
using (DESCryptoServiceProvider oDESCrypto = new DESCryptoServiceProvider())
                {
                    byte[] inputByteArray = Encoding.UTF8.GetBytes(stringToEncrypt);
                    MemoryStream oMemoryStream = new MemoryStream();
                    CryptoStream oCryptoStream = new CryptoStream(oMemoryStream,
                    oDESCrypto.CreateEncryptor(key, IV), CryptoStreamMode.Write);
                    oCryptoStream.Write(inputByteArray, 0, inputByteArray.Length);
                    oCryptoStream.FlushFinalBlock();
                    return Convert.ToBase64String(oMemoryStream.ToArray());
                }
            }
            catch
            {
                throw;
            }
        }

i followed this ph example but think i am way of course

 

<?php
 
class DES
{
      protected $method;
      protected $key;
        protected $output;
        protected $iv;
     protected $options;
    const OUTPUT_NULL = '';
    const OUTPUT_BASE64 = 'base64';
    const OUTPUT_HEX = 'hex';
 
    public function __construct($key, $method = 'DES-ECB', $output = '', $iv = '', $options = OPENSSL_RAW_DATA | OPENSSL_NO_PADDING)
    {
        $this->key = $key;
        $this->method = $method;
        $this->output = $output;
        $this->iv = $iv;
        $this->options = $options;
    }
 
  
    public function encrypt($str)
    {
        $str = $this->pkcsPadding($str, 8);
        $sign = openssl_encrypt($str, $this->method, $this->key, $this->options, $this->iv);
 
        if ($this->output == self::OUTPUT_BASE64) {
            $sign = base64_encode($sign);
        } else if ($this->output == self::OUTPUT_HEX) {
            $sign = bin2hex($sign);
        }
 
        return $sign;
    }
    public function decrypt($encrypted)
    {
        if ($this->output == self::OUTPUT_BASE64) {
            $encrypted = base64_decode($encrypted);
        } else if ($this->output == self::OUTPUT_HEX) {
            $encrypted = hex2bin($encrypted);
        }
 
        $sign = @openssl_decrypt($encrypted, $this->method, $this->key, $this->options, $this->iv);
        $sign = $this->unPkcsPadding($sign);
        $sign = rtrim($sign);
        return $sign;
    }
 
    private function pkcsPadding($str, $blocksize)
    {
        $pad = $blocksize - (strlen($str) % $blocksize);
        return $str . str_repeat(chr($pad), $pad);
    }
 
 
    private function unPkcsPadding($str)
    {
        $pad = ord($str{strlen($str) - 1});
        if ($pad > strlen($str)) {
            return false;
        }
        return substr($str, 0, -1 * $pad);
    }
 
}
 
$key = 'key123456';
$iv = 'iv123456';
 

$des = new DES($key, 'DES-CBC', DES::OUTPUT_BASE64, $iv);
echo $base64Sign = $des->encrypt('Hello DES CBC');
echo "\n";
echo $des->decrypt($base64Sign);
echo "\n";
 
$des = new DES($key, 'DES-ECB', DES::OUTPUT_HEX);
echo $base64Sign = $des->encrypt('Hello DES ECB');
echo "\n";
echo $des->decrypt($base64Sign);
 

 

Edited May 31 by Paulqvz
made les cluttered

Customer data is encrypted using OpenSSL, and then stored in mySQL varbinary column on a server.
It's now supposedly super safe -- because it can only be read using the secret key hidden right next to it.

Question: What if I encrypted that key?
And that key could only be decrypted with a passphrase submitted from my own dedicated computer?

Then I would be the only one able to read the encrypted customer data on my server, even if that server got hacked.

Obviously that would not work, because the server needs the untampered secret key in order to encrypt the data for mySQL.

Although this seems insurmountable, it feels more like a logic problem....where if you think about it long enough, the answer will come.

Any thoughts on this?

Thank you.

 

This is what the password encryption code looks like:
Code: [Select]
function passencr($username, $password){

$pepper = ******; //a hard-coded pepper.
$salt = ******; //a customizable salt defined by user.

$username = md5($username);
$password = md5($password);

$newpassword = sha1($username.$password);
$finalpassword = sha1($pepper.$newpassword.$salt);
return $finalpassword;
} 

So in this script both username and password are encrypted with md5 and then joined together to further encrypt with sha1 method. The finalized string is a combination of the new string, pepper and salt. I wonder if this is secure enough and whether there is a way to improve it.

I'm sorry if this seems like a stupid question, but I'm having trouble with this encryption and I'm a real noob at PHP.

This is for a registration form going into a mysql DB for integration with a gaming server that must use a Whirlpool Salt Hash encryption.

These are the variables for my form:

userPassword
userName
userEmail

This was my original encryption script (MD5)
Code: [Select]
$_POST['userPassword'] = md5($_POST['userPassword']);

This is the function that I am given to integrate into my website system:
Code: [Select]
function encryptPassword($password) {
$salt = substr(hash('whirlpool', uniqid(rand(), true)), 0, 12);
$hash = hash('whirlpool', $salt . $password);
$saltPos = (strlen($password) >= strlen($hash) ? strlen($hash) : strlen($password));
return substr($hash, 0, $saltPos) . $salt . substr($hash, $saltPos);
}
I've tried inserting the variable $_POST['userPassword'] in place for $password, but it gives me errors...

I'm stuck here, could someone show me how to properly integrate this? I think the problem isn't getting the password into the function but catching the returned variable

Sorry for my noobishnness,
-Nolam


EDIT:

I'm also given this for the login page to check the hash. If you could help me with this it would be greatly appreciated to. Thanks!!!

Code: [Select]
function checkPassword($realPass, $checkPass) {
//check for old encryption (md5 or whirlpool)
if (strlen($realPass) == 32 || strlen($realPass) == 128) {
$hash = (strlen($realPass) == 32 ? md5($checkPass) : hash('whirlpool', $checkPass));
if ($realPass == $hash) {
// change password to new encryption?
return true;
} else
return false;
}

// xAuth 2 encryption
$saltPos = (strlen($checkPass) >= strlen($realPass) ? strlen($realPass) : strlen($checkPass));

// extract salt
$salt = substr($realPass, $saltPos, 12);

$hash = hash('whirlpool', $salt . $checkPass);
return substr($hash, 0, $saltPos) . $salt . substr($hash, $saltPos) == $realPass;
}

Good day all, I need some help with a piece of code I wrote.
I have a 16 digit hex value whic I encrypt (3DES) with another 16 digit hex value. The result is a 32 digit hex value. The problem is I need to store the result in a 16 digit hex value to transport it to a host which will do the decryption.

$data = "3e5fa17b6ab1b1b1";
$key   = "0123456789abcdef";
$enc = mcrypt_cbc (mcrypt_3des, $key, $data, mcrypt_encrypt);  --> this results in 16 position raw binary data
$enc = bin2hex($enc);  --> I get a 32 digit hex value, but the space available will only fit a 16 digit hex value.

If i'm going about this totally wrong please let me know, this has been buggin me for some time now.
Any help would be grately appreciated.
Thank you.

hello everyone i'm new to PHP and i need your help. I'm developing a code which implements shannon-fano encryption algorithm with php. But i have problems with my function.
Basicly i try to do this:
1.Specofy a string to be coded.
2.Count the number of occurences of a character and write it in assoc array like this : "A"=>4,"B"=>2 etc. then i copy this array
3.After i have the array i sort it descending.
4.Divide the given array into two arrays where the sum of the values is almost equal.In the Copied array i set the value of the elements which fit into the fisrt divided array with 0 the rest with 1.
5.Each of the divided arrays i divide with recursion again until every symbol is into different array.and add to the value in the copied array 0 or 1;
6.I try to print the copied array.
here is my function which doesnt work and gives a lot of errors
function divide_array($array)
{
  $sum=0;
  $mid=array_sum($array)/2;
  foreach($array as $k=>$v)
  {
    if($sum<$mid){
      $sum=$sum+$array[$k];
      $up[$k]=$array[$k];
      $codeArr[$k]=0;
    }
    else
    {
       
      $down=array_slice($array,$k+1);
      $codeArr[$k]=1;
       
    }
  }
  divide_array($up);
  divide_array($down);
  echo "<pre>";
  print_r($codeArr);
  echo "</pre>";
}
 
i appreciate any help
PS:I know this can be done easier with trees but i don't understand them.

Writing an app that requires symmetric encryption.

I need to be able to have a key (such as 123) and be able to use this key and encrypt a string. Then decrypt the string later using the same key.

This encryption needs to be pretty robust and unbreakable.

Any functions or suggestions?!? Thinking of using the mcrypt library in some way.

Drez