Do not use mcrypt about cantiga

[zyxist]

I know about mcrypt, but there are some technical limitations on the external side that prevent us from using OpenSSL implementation right now (crappy hosting where entire PHP is broken).

[eXtreme]

I guessed that this was the case. You can still change it to use MCRYPT_RIJNDAEL_128 instead of _256. Citing:

MCRYPT_RIJNDAEL_256 refers to the version of the Rijndael cipher that operates on 256-bit blocks, not the version of the Rijndael cipher that uses 128-bit blocks and 256-bit keys. AES is only the 128-bit block version of Rijndael (which can use 128-, 192-, and 256-bit keys). So MCRYPT_RIJNDAEL_256 is not AES. AES is MCRYPT_RIJNDAEL_128.

The mcrypt methods determine the key size by the length of the string you pass in for the key. If you give it a 16-byte string, it'll use AES-128; if you give it a 32-byte string, it'll use AES-256.

Do not use MCRYPT_RIJNDAEL_256. Use MCRYPT_RIJNDAEL_128.

And add padding.

Follow the example from: https://paragonie.com/blog/2015/05/if-you-re-typing-word-mcrypt-into-your-code-you-re-doing-it-wrong

        $message = json_encode($output);
        if (mb_strlen($key, '8bit') !== 32) {
                throw new \RuntimeException('The key must have the length of 32 bytes!');
        }
        $ivsize = mcrypt_get_iv_size(MCRYPT_RIJNDAEL_128);
        $iv = mcrypt_create_iv($ivsize, MCRYPT_DEV_URANDOM);

        $block = mcrypt_get_block_size(MCRYPT_RIJNDAEL_128);
        $pad = $block - (mb_strlen($message, '8bit') % $block);
        $message .= str_repeat(chr($pad), $pad);

        $ciphertext = mcrypt_encrypt(
            MCRYPT_RIJNDAEL_128,
            $key,
            $message,
            MCRYPT_MODE_CBC,
            $iv
        );

        return $iv.$ciphertext;

[zyxist]

OK, as a part of the system generalization project I can start work on this.