How Can I Securely Encrypt and Decrypt Passwords in PHP?

Two-Way Encryption: Storing Retrievable Passwords

Encryption and Decryption

To encrypt and decrypt passwords in PHP, utilize an encryption class that encapsulates key stretching, IV hiding, HMAC verification, and other security measures. An example class implementation is provided:

class Encryption {
    // Cipher and mode used for encryption
    private $cipher;
    private $mode;

    // Constructor (usage example)
    public function __construct($cipher = MCRYPT_BLOWFISH, $mode = MCRYPT_MODE_CBC) {
        $this->cipher = $cipher;
        $this->mode = $mode;
    }

    // Encrypts data
    public function encrypt($data, string $key): string {
        // ...
    }

    // Decrypts data
    public function decrypt($data, string $key): string {
        // ...
    }
}

Choosing the Safest Algorithm

The most secure encryption methods are MCRYPT_BLOWFISH and MCRYPT_RIJNDAEL_128, with a block size of 8 bytes and MCRYPT_MODE_CBC mode.

Private Key Storage

To enhance security, consider using multiple keys: one for the user, one for the application, and one for the user-specific salt. Store the application-specific key securely, separate from the web root. Store the user-specific key in the database alongside the encrypted password. Require users to enter the private key when they need to decrypt passwords.

Preventing Password Compromise

To mitigate password theft, implement strict security measures to protect against system compromises, MITM attacks, and HTTP traffic sniffing. Use SSL for all traffic and eliminate any vulnerabilities on the server.

Additional Encryption Considerations

• Encrypted Data Size: The encrypted data size may vary based on the plain text's length, with an overhead range of approximately 80-87 characters.
• Decryption Time: Decryption using the example class takes around 0.5 seconds on average.
• Alternative Key Stretching Method: You can use a separate function to stretch the key instead of performing it within the PBKDF2 derivation.

The above is the detailed content of How Can I Securely Encrypt and Decrypt Passwords in PHP?. For more information, please follow other related articles on the PHP Chinese website!