SAsarciszewski·May 5, 2015Submission
Authenticated Encryption in PHP, Implemented Safely
2 points · Open discussiondefuse
php-encryption
PHP2014–2019
defuse / php-encryption
php-encryption
Simple Encryption in PHP.
4Distinct people
9Mentions
1Explicit recommenders
3.9KGitHub stars
What to know before exploring
What it is
Simple Encryption in PHP.
GitHub
Where it is used
No documented product use has been verified yet.
What people are saying
> If they update the library to match the newer expert opinion, it breaks existing code. If they do not update the library, then new applications using it will get the bad…
CiPHPerCoder used a recommendation phrase. One indexed comment matches. This is a phrase match, not a verdict.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 6:01:08 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year9 dated mentions
Observed mentions: 2014-02-23 03:30:59 UTC to 2019-03-15 14:18:34 UTC.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2014 | 2014-01-01 00:00:00 UTC | 2015-01-01 00:00:00 UTC | 1 | 1 | 0 |
| 2015 | 2015-01-01 00:00:00 UTC | 2016-01-01 00:00:00 UTC | 4 | 1 | 3 |
| 2016 | 2016-01-01 00:00:00 UTC | 2017-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2017 | 2017-01-01 00:00:00 UTC | 2018-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2018 | 2018-01-01 00:00:00 UTC | 2019-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2019 | 2019-01-01 00:00:00 UTC | 2020-01-01 00:00:00 UTC | 1 | 0 | 1 |
What Hacker News says
4 sources> Use a pre-existing cryptography package that has been written properly instead.
Okay, name one that has been written properly that the average web developer is going to encounter.
I'm going to focus on PHP because that's what I know best, it has an enormous market share, and I'm not a fan of blowing smoke (which I would be if I tried to speak to, e.g. Perl development).
PGP? OTR? Axolotl? These aren't part of your standard dev environment.
Mcrypt? Hasn't been touched since 2007. There is at least a patch for a bug in the 64-bit implementation of CAST-256 that has been sitting, unmerged, for six years.
Libsodium is the best we have, and you need PECL access to install it.
OpenSSL is labyrinthine. http://stackoverflow.com/a/29331937/2224584
It's still messy, despite the past year of attention from the security industry, but it's getting b
Read the rest
etter.
This library offloads its underlying cryptography to OpenSSL because it's the best we got:
https://github.com/defuse/php-encryption/
Maybe Python, Ruby, and Node developers have better options available to them. But 83% of the Internet runs PHP, and having a properly written cryptography package just isn't a trivial bar to leap over.
> If you're not using Sodium/Nacl, don't go out of your way to use Salsa/ChaCha/Poly1305.
Right, sorry if I implied that anyone should roll their own crypto libraries.
Use the standard implementations!
http://doc.libsodium.org/bindings_for_other_languages/README...
For PHP developers: https://github.com/defuse/php-encryption (wrapper for openssl)
In Be wary of one-time pads and other crypto unicorns> MCRYPT_RIJNDAEL_256
I hope you realize this isn't AES-256.
I strongly encourage you and anyone else who wants to play with encryption in PHP to just use https://github.com/defuse/php-encryption
Also, encryption isn't authentication. You'll probably quickly hear about Moxie Marlinspike's Cryptographic Doom Principle from others. Basically it means that you should be authenticating your ciphertexts.
Welcome to crypto, a lot can go wrong and some people have very strong opinions about it.
I highly recommend taking the time to go through the challenges on cryptopals.com (by the fine folks at Matasano) and learn more about it. :)
EDIT:
https://github.com/FranciscoP/secretdiary/blob/d5a04a7053597...
In your library, you're using ECB mode, with an IV, and not MACing anything...
In Show HN: Online journal that encrypts entries with a cipher