Php Openssl Generate Encryption Key
Posted on by admin
Generate ssh login key for non existing server. I know, this question has been ask several times. But Im trying to setup a ssh server.I thought the critical setting is that I have to set PasswordAuthentication no.
PHP: Basic two-way encryption Tweet 0 Shares 0 Tweets 6 Comments. While the trusty old PHP crypt function is perfect for encrypting and authenticating passwords, the hash it creates is one-way and doesn't allow for decryption. In this article we explore the art of two-way encryption in PHP which allows us to insert encrypted values into a form which are unreadable to the. // Generate a 256-bit encryption key // This should be stored somewhere instead of recreating it each time $ encryptionkey = opensslrandompseudobytes (32); // Generate an initialization vector // This.MUST. be available for decryption as well $ iv = opensslrandompseudobytes (opensslcipherivlength (AES256CBC)); // Create some data.
- Encrypt on the PHP side If you encrypt the data on the PHP side, you can make use of user-friendly packages (SymmetricEncryption or php-encryption spring to mind), and just store the encrypted string in your DB, which is a lot less complex.
- Here's an example encryption class I created in PHP. The encryption key is stored in this class, which can then be used to decrypt encrypted DB values. Hope this helps. /. Provides basic encryption and decryption of strings and objects.
- Encryption using PHP and OpenSSL Generating public / private Keys. We will first need a pair of public / private keys. Encrypting data. Here is the code that can be used to encrypt the data. Decrypting data. Once a user receives encrypted data using his public key.
- So, the OpenSSL is now installed on your Windows computer and we can generate the private and public keys. Click on your Windows start button and search for “Command Prompt” (cmd), right click on the “Command Prompt” and choose to “Run as administrator”. Click on “yes”, when the window for the administration conformation pops up.
Just a little note on [P.Peyremorte]'s note.
'- openssl_private_encrypt can encrypt a maximum of 117 chars at one time.'
This depends on the length of $key:
- For a 1024 bit key length => max number of chars (bytes) to encrypt = 1024/8 - 11(when padding used) = 117 chars (bytes).
- For a 2048 bit key length => max number of chars (bytes) to encrypt = 2048/8 - 11(when padding used) = 245 chars (bytes).
.. and so on
By the way, if openssl_private_encrypt fails because of data size you won't get anything but just false as returned value, the same for openssl_public_decrypt() on decryption.
'- the encrypted output string is always 129 char length. If you use base64_encode on the encrypted output, it will give always 172 chars, with the last always '=' (filler)'
This again depends on the length of $key:
- For a 1024 bit key length => encrypted number of raw bytes is always a block of 128 bytes (1024 bits) by RSA design.
- For a 2048 bit key length => encrypted number of raw bytes is always a block of 256 bytes (2048 bits) by RSA design.
.. and so on
About base64_encode output length, it depends on what you encode (meaning it depends on the bytes resulting after encryption), but in general the resulting encoded string will be about a 33% bigger (for 128 bytes bout 170 bytes and for 256 bytes about 340 bytes).
I would then generalize a little [P.Peyremorte]'s note by:
<?php
// given the variables as constants:
//Block size for encryption block cipher
private $ENCRYPT_BLOCK_SIZE = 200;// this for 2048 bit key for example, leaving some room
//Block size for decryption block cipher
private $DECRYPT_BLOCK_SIZE = 256;// this again for 2048 bit key
//For encryption we would use:
function encrypt_RSA($plainData, $privatePEMKey)
{
$encrypted = ';
$plainData = str_split($plainData, $this->ENCRYPT_BLOCK_SIZE);
foreach($plainData as $chunk)
{
$partialEncrypted = ';
//using for example OPENSSL_PKCS1_PADDING as padding
$encryptionOk = openssl_private_encrypt($chunk, $partialEncrypted, $privatePEMKey, OPENSSL_PKCS1_PADDING);
if($encryptionOk false){return false;}//also you can return and error. If too big this will be false
$encrypted .= $partialEncrypted;
}
return base64_encode($encrypted);//encoding the whole binary String as MIME base 64
}
//For decryption we would use:
protected function decrypt_RSA($publicPEMKey, $data)
{
$decrypted = ';
//decode must be done before spliting for getting the binary String
$data = str_split(base64_decode($data), $this->DECRYPT_BLOCK_SIZE);
foreach($data as $chunk)
{
$partial = ';
//be sure to match padding
$decryptionOK = openssl_public_decrypt($chunk, $partial, $publicPEMKey, OPENSSL_PKCS1_PADDING);
if($decryptionOK false){return false;}//here also processed errors in decryption. If too big this will be false
$decrypted .= $partial;
}
return $decrypted;
}
?>Openssl Generate Rsa Private Key
length of the data < length of the private key .so i divided the message while taking it,put a ':::'.then again encrpt it. look at the pgm to get an idea about this.
<?php
class cry
{
# generate a 1024 bit rsa private key, ask for a passphrase to encrypt it and save to file
//openssl genrsa -des3 -out /path/to/privatekey 1024
# generate the public key for the private key and save to file
//openssl rsa -in /path/to/privatekey -pubout -out /path/to/publickey
//programatically using php-openssll
//This will call while registration
function gen_cert($userid)
{
$dn = array('countryName' => 'XX', 'stateOrProvinceName' => 'State', 'localityName' => 'SomewhereCity', 'organizationName' =>'MySelf', 'organizationalUnitName' => 'Whatever', 'commonName' => 'mySelf', 'emailAddress' => 'user@example.com');
//Passphrase can be taken during registration
//Here its initialized to 1234 for sample
$privkeypass = 'root';
$numberofdays = 365;
//RSA encryption and 1024 bits length
$privkey = openssl_pkey_new(array('private_key_bits' => 1024,'private_key_type' => OPENSSL_KEYTYPE_RSA));
$csr = openssl_csr_new($dn, $privkey);
$sscert = openssl_csr_sign($csr, null, $privkey, $numberofdays);
openssl_x509_export($sscert, $publickey);
openssl_pkey_export($privkey, $privatekey, $privkeypass);
openssl_csr_export($csr, $csrStr);
//Generated keys are stored into files
$fp=fopen('./PKI/private/$userid.key','w');
fwrite($fp,$privatekey);
fclose($fp);
$fp=fopen('./PKI/public/$userid.crt','w');
fwrite($fp,$publickey);
fclose($fp);
}
//Encryption with public key
function encrypt($source,$rc)
{
//path holds the certificate path present in the system
$path='./PKI/public/server.crt';
$fp=fopen($path,'r');
$pub_key=fread($fp,8192);
fclose($fp);
openssl_get_publickey($pub_key);
//$source=';
//$source='sumanth ahoiadodakjaksdsa;ldadkkllksdalkalsdl;asld;ls sumanthasddddddddddddddddddddddddddddddddfsdfsffdfsdfsumanth';
$j=0;
$x=strlen($source)/10;
$y=floor($x);
for($i=0;$i<$y;$i++)
{
$crypttext=';
openssl_public_encrypt(substr($source,$j,10),$crypttext,$pub_key);$j=$j+10;
$crt.=$crypttext;
$crt.=':::';
}
if((strlen($source)%10)>0)
{
openssl_public_encrypt(substr($source,$j),$crypttext,$pub_key);
$crt.=$crypttext;
}
return($crt);
}
//Decryption with private key
function decrypt($crypttext,$userid)
{
$passphrase='root';
$path='./PKI/private/server.key';
$fpp1=fopen($path,'r');
$priv_key=fread($fpp1,8192);
fclose($fpp1);
$res1= openssl_get_privatekey($priv_key,$passphrase);
$tt=explode(':::',$crypttext);
$cnt=count($tt);
$i=0;
while($i<$cnt)
{
openssl_private_decrypt($tt[$i],$str1,$res1);
$str.=$str1;
$i++;
}
return $str;
}
function sign($source,$rc)
{
$has=sha1($source);
$source.='::';
$source.=$has;
$path='./PKI/public/$rc.crt';
$fp=fopen($path,'r');
$pub_key=fread($fp,8192);
fclose($fp);
openssl_get_publickey($pub_key);
openssl_public_encrypt($source,$mese,$pub_key);
return $mese;
}
function verify($crypttext,$userid)
{
$passphrase='root';
$path='./PKI/private/$userid.key';
$fpp1=fopen($path,'r');
$priv_key=fread($fpp1,8192);
fclose($fpp1);
$res1= openssl_get_privatekey($priv_key,$passphrase);
openssl_private_decrypt($crypttext,$has1,$res1);
list($c1,$c2)=split('::',$has1);
$has=sha1($c1);
if($has$c2)
{
$message=$c1;
return $message;
}
}
}
?>