Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:63208
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.212.42 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <505B2CA7.6050505@codeangel.org>
References: <505B2CA7.6050505@codeangel.org>
Date: Thu, 20 Sep 2012 20:22:38 +0300
Message-ID: <CANVTSm591cQV45y8ikT36Vtd6+JniNLGfdgQNYapy52QejBtdw@mail.gmail.com>
To: Chad Emrys <admin@codeangel.org>
Cc: internals php list <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=e89a8f503b72e3dba104ca255f60
Subject: Re: [PHP-DEV] Authenticated Encryption in PHP
From: g.b.yahav@gmail.com (Yahav Gindi Bar)

--e89a8f503b72e3dba104ca255f60
Content-Type: text/plain; charset=ISO-8859-1

To be honest, I've thought about it today and think that it could be great!
:) I'd love to help if it's possible in any way I can :)

On Thu, Sep 20, 2012 at 5:48 PM, Chad Emrys <admin@codeangel.org> wrote:

> Hello,
>
> I was wondering how difficult it would be to add access to a standard
> authenticated encryption mode in openssl.  I was looking and trying to
> figure out how to do this in PHP, seems you have to do it the old fashioned
> way that's way too prone to error, basically encrypt and mac yourself.
>  This has been shown to be really easy to mess up, but now we have
> standards such as GCM, CCM, and EAX.  GCM seems to be the popular choice
> since it's the fastest, unencumbered by patents, and adopted by NIST.
> (Also personally like GCM, because that's also what the JCE went with and I
> have interest in using encryption between Java and PHP).  It seems openssl
> lib in C does have support for GCM, so I was wondering how difficult would
> it be to offer such cipher options in PHP's openssl functions such as
> "aes-128-gcm" etc...  Possibly throwing an error when the tag fails (or
> maybe something better, as if the user has display errors on, there have
> been known attacks letting an attacker know if the tag failed vs other
> reasons decryption failed).
>
> Chad
>
> --
> PHP Internals - PHP Runtime Development Mailing List
> To unsubscribe, visit: http://www.php.net/unsub.php
>
>

--e89a8f503b72e3dba104ca255f60--