Forum Moderators: coopster
I have been looking around on how to crypt and decrypt a variable.
I have looked up a phpnoise tutorial but I can't get it to go for me on the system I am using.
I would like to be able to encrypt an input and store it on a flat file database on one page. Then I would like to be able to call up the flat file database and decrypt it, on another page.
Do I have to use gnupgp for this?
Thank you.
Well I have tried to do it using the php.net examples but I can't seem to get it going.
Here is my situation:
I have a newsletter subscribe process which adds the email to the flat file database - which I would like to encrypt.
So I have done this:
$iv_size = mcrypt_get_iv_size(MCRYPT_RIJNDAEL_256, MCRYPT_MODE_ECB);
$iv = mcrypt_create_iv($iv_size, MCRYPT_RAND);
$key = "f98hdrfg98dfkjg";
$text = $_GET["email"];
$encemail = mcrypt_encrypt(MCRYPT_RIJNDAEL_256, $key, $text, MCRYPT_MODE_ECB, $iv);
And I write $encemail to the database and that seems to go fine.
Now I am in administration and I would like to view the subscribers so I must decrypt the data.
Here is the code:
$iv_size = mcrypt_get_iv_size(MCRYPT_RIJNDAEL_256, MCRYPT_MODE_ECB);
$iv = mcrypt_create_iv($iv_size, MCRYPT_RAND);
$key = "f98hdrfg98dfkjg";
$buffer2 = $buffer;
$encemail = mcrypt_decrypt(MCRYPT_RIJNDAEL_256, $key, $buffer2, MCRYPT_MODE_ECB, $iv);
It shows the email encrypted.
I think this problem might have something to do with the MCRYPT_RAND...
Added: In other words, pass the key and the IV to the decrypt function. The IV can be stored with the encrypted data.
$iv_size = mcrypt_get_iv_size(MCRYPT_RIJNDAEL_256, MCRYPT_MODE_ECB);
$iv = mcrypt_create_iv($iv_size, dfg98dnfg);
//changed rand
$key = "f98hdrfg98dfkjg";
$buffer2 = $buffer;
mcrypt_create_iv() expects parameter 2 to be long
Are you saying that it still won't work?
Do I need the iv?
When decrypting, $iv should be equal to what was generated from that function during the encryption of the data.
Instead of writing to a DB, try encrypting and decrypting on the same page, printing out the results of each step.
test.php
<html>
<body>
<a href="test2.php?text=howdy">test2</a>
</body>
</html>
test2.php
<?
$iv_size = mcrypt_get_iv_size(MCRYPT_RIJNDAEL_256, MCRYPT_MODE_ECB);
$iv = mcrypt_create_iv($iv_size, 345);
$key = "This is a very secret key";
$text = $_GET["text"];
echo strlen($text) . "\n";
$crypttext = mcrypt_encrypt(MCRYPT_RIJNDAEL_256, $key, $text, MCRYPT_MODE_ECB, $iv);
$crypttext2 = mcrypt_decrypt(MCRYPT_RIJNDAEL_256, $key, $text, MCRYPT_MODE_ECB, $iv);
echo strlen($crypttext2) . "\n";
echo strlen($crypttext) . "\n";
?>
Gives:
5 32 32
...
should be
$crypttext2 = mcrypt_decrypt(MCRYPT_RIJNDAEL_256, $key, $crypttext, MCRYPT_MODE_ECB, $iv);
$iv_size = mcrypt_get_iv_size(MCRYPT_RIJNDAEL_256, MCRYPT_MODE_ECB);
$iv = mcrypt_create_iv($iv_size, 345);
$key = "This is a very secret key";
$text = $_GET["text"];
echo strlen($text) . "\n";
$crypttext = mcrypt_encrypt(MCRYPT_RIJNDAEL_256, $key, $text, MCRYPT_MODE_ECB, $iv);
$crypttext2 = mcrypt_decrypt(MCRYPT_RIJNDAEL_256, $key, $crypttext, MCRYPT_MODE_ECB, $iv);
echo strlen($crypttext2) . "\n";
echo strlen($crypttext) . "\n";
?>
It still returns the same... as numbers. I am assuming one would be numbers and one would be the text I sent.
echo ($crypttext2) . "\n";
echo ($crypttext) . "\n";
5 howdy
However, if you are able to see the decrypted text, that means your decryption routine is working. Congrats! :)
subscribe_process
<?php
#####################
#
# Newsletter subscribe
#
#####################
$new_email_address = $_GET['email'];
$new_email_id = $_GET['id'];
$found = FALSE;
$file = file_get_contents('tmp.txt');
$lines = explode("\n", $file);
foreach($lines as $line)
{
$info = explode('¦', $line);
if($info[0] == $new_email_address)
{
if($info[1] == $new_email_id)
{
$found = TRUE;
$user_info = $info;
}
else
{
$awaiting = implode('¦', $info)."\n";
}
}
else
{
$awaiting = implode('¦', $info)."\n";
}
}
if($found)
{
$contents = file_get_contents('subscribers.txt');
$subscribers = explode(",", $contents);
if(in_array($new_email_address, $subscribers))
{
$result = TRUE;
}
else
{
$result = FALSE;
}
if($result)
{
$msg = "
<h3>
Sorry, we cannot add you as... you already exist on this list...
</h3>
";
}
else
{
$fp2 = fopen('tmp.txt', "w");
fwrite($fp2, $awaiting);
fclose($fp2);$iv_size = mcrypt_get_iv_size(MCRYPT_RIJNDAEL_256, MCRYPT_MODE_ECB);
$iv = mcrypt_create_iv($iv_size, 489);
$key = "f8ghh9 98sdfhg se98";
$text = $_GET["email"];$cryptemail = mcrypt_encrypt(MCRYPT_RIJNDAEL_256, $key, $text, MCRYPT_MODE_ECB, $iv);
$fp = fopen("subscribers.txt", "a+");
fwrite($fp, $cryptemail . ",");
fclose($fp);
$msg = "
<h3>
You have been added to the newsletter. Thanks!
</h3>
";
}
}
else
{
die('Not found');
}
$page = 'about';
include ("inc/files/header.php");
?>
<!-- content -->
<div id="content">
<?php echo $msg;?>
</div>
<!-- // content -->
<?php
include ("inc/files/footer.php");
?>
Subscribers
<?
#####################
#
# Newsletter subscribers
#
#####################
session_start();
require_once("includes/config.php");
if($_SESSION["valid"] == true)
{$iv_size = mcrypt_get_iv_size(MCRYPT_RIJNDAEL_256, MCRYPT_MODE_ECB);
$iv = mcrypt_create_iv($iv_size, 489);
$key = "f8ghh9 98sdfhg se98";
$text = $buffer;$buffer = mcrypt_decrypt(MCRYPT_RIJNDAEL_256, $key, $text, MCRYPT_MODE_ECB, $iv);
if($_GET["action"] == "add")
{
$fp = fopen("subscribers.txt", "r");
$file_text = fread($fp, 999999);
fclose($fp);
$subscribers = explode(",",$file_text);
foreach($subscribers as $subscriber)
{
if($subscriber == $_GET["email"])
{
$result = 1;
break;
}
else
{
$result = 0;
}
}
if($result == 1)
{
$msg = "
<div class=error>
Cannot add subscriber, subscriber already exists...
</div>
";
}
else
{
$fp = fopen("subscribers.txt", "a+");
fwrite($fp, $_GET["email"] . ",");
fclose($fp);
$msg = "
<div class=message>
Subscriber added successfully...
</div>
";
}
}
if($_GET["action"] == "delete")
{
$fp = fopen("subscribers.txt", "r");
$file_text = fread($fp, 999999);
fclose($fp);
$fp = fopen("subscribers.txt", "w");
$file_text_new = str_replace("$_GET[email],", "", $file_text);
fwrite($fp, $file_text_new);
fclose($fp);
$msg = "
<div class=message>
Subscriber deleted successfully...
</div>
";
}
if(isset($msg)) $main .= "$msg
<br>
";
$main .= "
<div class=heading2>
Add a subscriber
</div>
<br>
<form name=add action='subscribers.php' method='get'>
<br>
<input class=textField type=text name=email>
<br>
<br>
<input type=hidden name=action value=add>
<input class=button type=submit value=Add>
</form>
<script language=javascript>
var validator = new Validator('add');
validator.addValidation('email','req','Please enter a valid email');
validator.addValidation('email','email','Please enter a valid email');
</script>
<br>
<div class=heading2>
Delete a subscriber
</div>
<br>
<form action='subscribers.php' method='get'>
<br>
<select class=textField name=email>
";$fp = fopen("subscribers.txt", "r");
while (!feof($fp))
{
$char = fread($fp, 1);
if($char == ",")
{
$main .= "
<option>
$buffer
</option>
";
$buffer = "";
}
else
{
$buffer .= "$char";
}
}
fclose($fp);
$main .= "
</select>
<br>
<br>
<input type=hidden name=action value=delete>
<input class=button type=submit value=Delete>
</form>
";
}
else
{
header("Location: index.php");
}
$page = "subscribers";
require_once("includes/template.php");
?>
It doesn't decrypt for the select field.
$iv_size = mcrypt_get_iv_size(MCRYPT_RIJNDAEL_256, MCRYPT_MODE_ECB);
$iv = mcrypt_create_iv($iv_size, 489);
echo $iv;
Then copy and paste whatever you get into your "includes/config.php" file as:
$iv = 'whatever you got';
Next, add this line to your subscribe_process.php script, at the top:
require_once("includes/config.php");
Then delete these lines from both of your scripts:
$iv_size = mcrypt_get_iv_size(MCRYPT_RIJNDAEL_256, MCRYPT_MODE_ECB);
$iv = mcrypt_create_iv($iv_size, 489);
Why all the above? Because since you aren't generating a random $iv each time, you might as well just make one $iv and stop trying to make it every time. $iv is just a string to make your encryption unique to you.
Finally, add this line into your Subscribers.php file:
$key = "f8ghh9 98sdfhg se98";
echo 'Before: '.$buffer.'<br>';
$text = $buffer;
$buffer = mcrypt_decrypt(MCRYPT_RIJNDAEL_256, $key, $text, MCRYPT_MODE_ECB, $iv);
echo '<br>After: '.$buffer.'<br>';
I can't see what $buffer is defined as. Let me know what gets echoed. I suspect the problem is how $text is defined.
Ok I did what you said and it gives me a warning saying the $iv is too large. Should I make it smaller?
Also... I put the $buffer bit where I think it shoudl go, and it worked-ish. The email got decrypted but it has lots of 0's after it.
Here is the subscribers.php file
<?
#####################
#
# Newsletter subscribers
#
#####################
session_start();
require_once("includes/config.php");
if($_SESSION["valid"] == true)
{if($_GET["action"] == "add")
{
$fp = fopen("subscribers.txt", "r");
$file_text = fread($fp, 999999);
fclose($fp);
$subscribers = explode(",",$file_text);
foreach($subscribers as $subscriber)
{
if($subscriber == $_GET["email"])
{
$result = 1;
break;
}
else
{
$result = 0;
}
}
if($result == 1)
{
$msg = "
<div class=error>
Cannot add subscriber, subscriber already exists...
</div>
";
}
else
{
$fp = fopen("subscribers.txt", "a+");
fwrite($fp, $_GET["email"] . ",");
fclose($fp);
$msg = "
<div class=message>
Subscriber added successfully...
</div>
";
}
}
if($_GET["action"] == "delete")
{
$fp = fopen("subscribers.txt", "r");
$file_text = fread($fp, 999999);
fclose($fp);
$fp = fopen("subscribers.txt", "w");
$file_text_new = str_replace("$_GET[email],", "", $file_text);
fwrite($fp, $file_text_new);
fclose($fp);
$msg = "
<div class=message>
Subscriber deleted successfully...
</div>
";
}
if(isset($msg)) $main .= "$msg
<br>
";
$main .= "
<div class=heading2>
Add a subscriber
</div>
<br>
<form name=add action='subscribers.php' method='get'>
<br>
<input class=textField type=text name=email>
<br>
<br>
<input type=hidden name=action value=add>
<input class=button type=submit value=Add>
</form>
<script language=javascript>
var validator = new Validator('add');
validator.addValidation('email','req','Please enter a valid email');
validator.addValidation('email','email','Please enter a valid email');
</script>
<br>
<div class=heading2>
Delete a subscriber
</div>
<br>
<form action='subscribers.php' method='get'>
<br>
<select class=textField name=email>
";$fp = fopen("subscribers.txt", "r");
while (!feof($fp))
{
$char = fread($fp, 1);
if($char == ",")
{$key = "f8ghh9 98sdfhg se98";
echo 'Before: '.$buffer.'<br>';
$text = $buffer;
$buffer = mcrypt_decrypt(MCRYPT_RIJNDAEL_256, $key, $text, MCRYPT_MODE_ECB, $iv);
echo '<br>After: '.$buffer.'<br>';
$main .= "
<option>
$buffer
</option>
";
$buffer = "";
}
else
{
$buffer .= "$char";
}
}
fclose($fp);
$main .= "
</select>
<br>
<br>
<input type=hidden name=action value=delete>
<input class=button type=submit value=Delete>
</form>
";
}
else
{
header("Location: index.php");
}
$page = "subscribers";
require_once("includes/template.php");
?>
So, I expect that the output of subscribers.php is (the part about $buffer, I know there is a lot more output.)
Before: dfs87dsf879vs7d89v7sd89f7sfs... (the encrypted email)
After: somebody@somedomain.tld000000000000000000000000000000
Is that accurate? If so, I have no clue why the 0s are there. Rather than spend time figuring it out, I'd take a look at rtrim [php.net] and just get rid of them.
Here is the code:
$key = "f8ghh9 98sdfhg se98";
echo 'Before: '.$buffer.'<br>';
$text = $buffer;
$buffer = mcrypt_decrypt(MCRYPT_RIJNDAEL_256, $key, $text, MCRYPT_MODE_ECB, $iv);echo '<br>After: '.$buffer.'<br>';
$trimmed = rtrim($buffer, " \0.");
echo '<br>After trim: '.$trimmed.'<br>';
I still get the warning:
Warning: mcrypt_decrypt(): The IV parameter must be as long as the blocksize
<?
#####################
#
# Newsletter subscribers
#
#####################
session_start();
require_once("includes/config.php");
if($_SESSION["valid"] == true)
{if($_GET["action"] == "add")
{
$fp = fopen("subscribers.txt", "r");
$file_text = fread($fp, 999999);
fclose($fp);
$subscribers = explode(",",$file_text);
foreach($subscribers as $subscriber)
{
if($subscriber == $_GET["email"])
{
$result = 1;
break;
}
else
{
$result = 0;
}
}
if($result == 1)
{
$msg = "
<div class=error>
Cannot add subscriber, subscriber already exists...
</div>
";
}
else
{$key = "f8ghh9 98sdfhg se98";
$text = $_GET["email"];$cryptemail = mcrypt_encrypt(MCRYPT_RIJNDAEL_256, $key, $text, MCRYPT_MODE_ECB, $iv);
$fp = fopen("subscribers.txt", "a+");
fwrite($fp, $cryptemail . ",");
fclose($fp);
$msg = "
<div class=message>
Subscriber added successfully! Yay!
</div>
";
}
}
if($_GET["action"] == "delete")
{
$fp = fopen("subscribers.txt", "r");
$file_text = fread($fp, 999999);
fclose($fp);$key = "f8ghh9 98sdfhg se98";
$text = $_GET["email"];
$text = mcrypt_decrypt(MCRYPT_RIJNDAEL_256, $key, $text, MCRYPT_MODE_ECB, $iv);$email2 = rtrim($text, " \0.");
$fp = fopen("subscribers.txt", "w");
$file_text_new = str_replace("$email2,", "", $file_text);
fwrite($fp, $file_text_new);
fclose($fp);
$msg = "
<div class=message>
Subscriber deleted successfully...
</div>
";
}
if(isset($msg)) $main .= "$msg
<br>
";
$main .= "
<div class=heading2>
Add a subscriber
</div>
<br>
<form name=add action='subscribers.php' method='get'>
<br>
<input class=textField type=text name=email>
<br>
<br>
<input type=hidden name=action value=add>
<input class=button type=submit value=Add>
</form>
<script language=javascript>
var validator = new Validator('add');
validator.addValidation('email','req','Please enter a valid email');
validator.addValidation('email','email','Please enter a valid email');
</script>
<br>
<div class=heading2>
Delete a subscriber
</div>
<br>
<form action='subscribers.php' method='get'>
<br>
<select class=textField name=email>
";$fp = fopen("subscribers.txt", "r");
while (!feof($fp))
{
$char = fread($fp, 1);
if($char == ",")
{$key = "f8ghh9 98sdfhg se98";
$text = $buffer;
$buffer = mcrypt_decrypt(MCRYPT_RIJNDAEL_256, $key, $text, MCRYPT_MODE_ECB, $iv);$buffer = rtrim($buffer, " \0.");
$main .= "
<option>
$buffer
</option>
";
$buffer = "";
}
else
{
$buffer .= "$char";
}
}
fclose($fp);
$main .= "
</select>
<br>
<br>
<input type=hidden name=action value=delete>
<input class=button type=submit value=Delete>
</form>
";
}
else
{
header("Location: index.php");
}
$page = "subscribers";
require_once("includes/template.php");
?>
It doesn't delete it...
As far as the $iv needing to match the size of the encrypted message, the mcrypt_get_iv_size [php.net] function or the mcrypt_enc_get_iv_size [php.net] would need to accept the message or the length of the message for that to be a factor, right? But all it accepts is the cipher and mode, so length of message could not possibly be a factor.
