Update 2015-07-22: The specific problems listed below have, for the most part, been remedied. More work remains to be done to clean up other instances of insecure code or bad security advice.
If anyone else finds themselves in the same situation, where there's an insecure code snippet in a high-scoring or accepted answer and your edits are being rejected by the reviewers, refer to the accepted answer. Go join room 11 and ask for help. Some of the moderators frequent this room and might be willing to help.
If anyone is unsure about whether or not a particular answer is secure, feel free to ask me (security@
).
The top results for a Google Search for php encryption are:
How do you Encrypt and Decrypt a PHP String?
Before I submitted my answer, none of the existing answers were properly authenticating ciphertexts.
Simplest two-way encryption using PHP
I am unable to provide an answer because this question is closed.~ All of its advice is terrible. The accepted question usesMCRYPT_RIJNDAEL_256
as a cipher,md5($key)
(yes, hex-encoded) as a key, andmd5(md5($key))
as an IV. Also, once again, it uses no MAC.I was able to submit a new answer: https://stackoverflow.com/a/30189841/2224584
How to encrypt/decrypt data in php?
The accepted answer originally did not authenticate ciphertexts. After a brief discussion, this was quickly amended.
Irrelevant (code obfuscation question)
How do I encrypt a string in PHP?
Unauthenticated encryption, yet again. It's very important that encryption libraries include message authentication in order to be secure. Eugene's answer (not the accepted one) authenticates ciphertexts.
Two-way encryption: I need to store passwords that can be retrievedThis authenticates ciphertexts with an HMAC construct, but is vulnerable to timing attacks.note: this has been rectified and the security issues in the answer fixed.
XOR encryption -- no comment really necessary
Encrypt with PHP, Decrypt with Javascript (cryptojs)
MCRYPT_RAND
is terrible for IVs- Unauthenticated ciphertexts
CryptoJS-specific
-
- Unauthenticated ciphertexts
- Padding oracle because of naive
rtrim($plaintext, "\0");
MCRYPT_RAND
again- Update: I was able to provide an answer here: https://stackoverflow.com/a/30166085/2224584
This is terrible.
Developers who come to Stack Overflow should be given better cryptography advice. Namely:
- Unless you're a crypto expert, don't roll your own crypto in production. Instead, you want to use one of the following:
- libsodium (if you can install PECL extensions)
- defuse/php-encryption if you cannot
Zend\Crypt
if you're using a compatible framework
- Use AEAD constructions where available, Encrypt-Then-MAC where they're not
- Use
/dev/urandom
for encryption keys, IVs, nonces, etc.
I know Stack Overflow cannot control Google's search results, but we certainly can clean up the pages that users read when they click on popular answers.
This is not a general policy question about dangerous answers, it's a call to action to replace the bad security advice that users are likely to encounter with information less likely to leave them vulnerable.
One of my issues with the current state of things is that my edits are universally being rejected because I "should have submitted them as a separate answer instead". However, I can't answer closed questions. So even if I have a correct answer that will lead users to a better approach, I can't post it.
My attempts to remedy insecure code and bad cryptography advice have been rejected because they "changed the intent" of the original answer. What should be the correct way to promote better security practices here?
<meta name="robots" content="noindex,follow" />
added to their<head />
block, then. Let's get them knocked off the front page of Google if we can't propose better solutions.