mcrypt_encrypt(): printed output with strange characters

vale_ron

Hi guys,

I just searched in the forum, but I didn't found the solution to my problem. The scenario is the following: I want to store in a file an encrypted database password and in run-time I want to read it from the file and decrypt it to connect to the DB.
The problem is that the output of the function returns strange characters, like these:

gSîBº[j—JëIž™Žº…Õ9˜Ö¯Ã*Óeg
I guess this is not correct 🙂

Here the code (founded in this forum):

<?php

function encryptData($value){
   $key = "top secret key";
   $text = $value;
   $iv_size = mcrypt_get_iv_size(MCRYPT_RIJNDAEL_256, MCRYPT_MODE_ECB);
   $iv = mcrypt_create_iv($iv_size, MCRYPT_RAND);
   $crypttext = mcrypt_encrypt(MCRYPT_RIJNDAEL_256, $key, $text, MCRYPT_MODE_ECB, $iv);
   return $crypttext;
} 

$handle = fopen("/home/valeron/Desktop/crypt/pass.txt","a");
fwrite($handle,encryptData("valerio"));
fclose($handle);

?>

Could you help me to fix this issue, please?

Thank you very much!

NogDog

Most such encryption schemes generate binary data, not text, so the output is probably correct in that it is simply reading every group of 8 binary bits as a character, which is essentially meaningless in this case. If you are storing this encrypted data in the database, you'll therefore want that DB field to be defined as a binary type, not a character type field (e.g., one of the BLOB types).

vale_ron

OK, understand the problem.

But I wouldn't store the password in byte format, I prefer text format. Can you suggest me a way to do this? Remember that I can' t use md5() or other hash function, because I must be able to decrypt the text.

Thanks.

NogDog

Well, it doesn't really matter what you prefer. 😉 The fact is that the encryption generates binary data, so if you want to store that directly into the database, it should be stored as such. I suppose you could [man]base64_encode/man it before storing it in a character/text field, but that adds another step in the process both for storing and retrieving it without any functional benefit that I can see (plus increasing the amount of disk space needed for storing each password, not that disk space is often a problem these days). Once encrypted, there should never be any need to output the encrypted value (other than testing and/or curiosity). If retrieving for some reason, you'll presumably be decrypting it before doing anything with it (e.g. emailing it for a lost password). If validating a login, there's no need to retrieve it at all, just encrypt the input password and do the comparison as part of the login validation database query. (In fact, I prefer to use the database's encryption/decryption functions and let the DBMS do all that work instead of my PHP code.)