chuyskywalker / phpaes

A class for performing AES encryption with mcrypt or openssl.

phpaes

A class for performing AES encryption with mcrypt or openssl. Includes benchmarks, full unit tests, and cross-engine validation.

Originally written as part of a blog entry called PHP: AES Mcrypt & OpenSSL

phpaes's Issues

Consider dropping `php-5.x` version supports

As title, this issue should be considered.

Since the php-5.x versions are unsupported in PHP team, we should let this package require php-7.1+ versions at least.

The ext-mcrypt extension is deprecated since the php-7.1 is released.

I think we can do following works to resolve issue:

• Drop php-5.x versions.
• Drop ext-mcrypt support and let ext-sodium and ext-openssl extension supports.

Once this issue is accepted, I'm happy to work on this :).

LICENSE

Any plan of adding a BSD?

Potential problem using strlen()

In the code you are using strlen() to get length size of a string in multiple places.

In most cases this function will work fine and return the byte size of the string (that's what we need when performing encryption)

but if in the php.ini file we setted mbstring.func_overload then the method mb_strlen() will be used instead of the classic strlen() and this method by default count the number of characters.

Since an UTF-8 character can take up to 4 bytes the number of characters and the number of bytes can be different.

// A system where mbstring.func_overload is not set
$foo = "bär";
echo strlen($foo); //Will print 4 because the string take 4 bytes
echo mb_strlen($foo); //Will print 3, th number of characters

To avoid this kind of problem a custom method to determine the string length should be implemented.

Here's an example from another project:

private static function ourStrlen($str) {
    static $exists = null;
    if ($exists === null) {
        $exists = \function_exists('mb_strlen');
    }
    if ($exists) {
        $length = \mb_strlen($str, '8bit');
        if ($length === FALSE) {
            throw new Ex\CannotPerformOperation();
        }
        return $length;
    } else {
        return \strlen($str);
    }
}

Release new version

Hi Jeff,

I was wondering if you could maybe tag the current master as a new version. The latest tag (v1.0.1) is ~ 1.5 years old, while some nice fixes (string length checks) were added a while back.

Diff since v1.0.1: v1.0.1...0a9ed81

Padding without blocksize length check

Hey Jeff,

I found your lib while searching for informations about the pkcs#7 padding and AES encryption. I've checked your padding code, and think I have found multiple minor problems with it:

• If someone uses only your padding code without your AES code, they can use the padding with a blocksize of more than 256 bytes. PKCS#7 is working only for block sizes smaller than 256 bytes (0xFF as padding value). (see http://tools.ietf.org/html/rfc5652#section-6.3)
• You do not check the padding, before removing it from the data. You should check the padding before removing it, to detect wrong or broken paddings and reject the data.

HTH
Oliver

mcrypt is gone... update composer.json?

Hi,

As of PHP 7.3, mcrypt is removed.

If I'm reading the code right, phpaes requires either mcrypt or openssl.

Seems like a simple update to composer.json would make composer happy with it when running PHP 7.3?