The companion library for MCrypt is Libmcrypt, which contains the actual encryption functions themselves. Windows users can download it here, while Linux users can get it here.

Installing Libmcrypt:

1. Download libmcrypt.dll.
2. Copy the libmcrypt.dll file to {php_home}/ext and {Windows_home}/System32.
3. In php.ini activate the extension=php_mcrypt.dll line by deleting the comment mark (“;”).
4. Save the updated php.ini file.

MCrypt can operate with the four cipher modes CBC, OFB, CFB, and ECB. If you are using a libmcrypt-2.4.x version or higher, then MCrypt functions also operate with the nOFB and STREAM cipher modes. Table 2 shows the most commonly-used encryption modes, along with a short description of when to use each.

In addition to the modes listed in Table 2, MCrypt also currently supports these ciphers:

• MCRYPT_3DES
• MCRYPT_ARCFOUR
• MCRYPT_BLOWFISH
• MCRYPT_ENIGMA
• MCRYPT_GOST
• MCRYPT_IDEA (non-free)
• MCRYPT_LOKI97
• MCRYPT_MARS
• MCRYPT_PANAMA
• MCRYPT_RIJNDAEL_128

MCrypt Example
Here’s an example that shows how to encrypt and decrypt the contents of a text file using MCrypt. Again, the example encrypts the contents of textfile.txt and stores the encrypted result in the file encrypted.txt. However, this example also decrypts that file and stores the unencrypted text in the file newfile.txt:

   // Listing file_encrypt.php
<?php

$file = 'textfile.txt';
$initial_contents = file_get_contents($file);

if($initial_contents){

//This function opens the module of the algorithm and the mode to be used
$td = mcrypt_module_open('tripledes', '', 'ecb', '');

//Create an initialization vector (IV) from a random source
$iv = mcrypt_create_iv (mcrypt_enc_get_iv_size($td), MCRYPT_RAND);

//This function initializes all buffers needed for encryption
mcrypt_generic_init($td, $initial_contents, $iv);

//This function encrypts data
$encrypted_data = mcrypt_generic($td, $initial_contents);

$encrypted_file = @fopen('encrypted.txt','w');
$ok_encrypt = @fwrite($encrypted_file,$encrypted_data);
if($ok_encrypt){
echo 'The encrypted code was succesfully created '.
'in encrypted_file.txt!!!'.'<br />';
}
else{
echo ("The write of this file failed!");
}

@fclose($encrypted_file);

mcrypt_generic_init($td, $initial_contents, $iv);

//This function decrypts data
$p_t = mdecrypt_generic($td, $encrypted_data);

$newfile = @fopen('newfile.txt','w');
$ok_decrypt = @fwrite($newfile,$p_t);
if($ok_decrypt){
echo 'The decrypted code was succesfully created '.
'in newfile.txt!!!'.'<br />';
}
else{
echo ("The write of this file failed!");
}
@fclose($newfile);

//This function deinitializes an encryption module
mcrypt_generic_deinit($td);

//Close the mcrypt module
mcrypt_module_close($td);
}

?>

Installing Libmhash

1. Download libmhash.dll.
2. Copy the libmhash.dll file to {php_home}/ext and to {Windows_home}/System32.
3. In php.ini, activate the extension=php_mhash.dll line by deleting the comment mark (”;”).
4. Save the updated php.ini file.

Supported Hashes
The hashes currently supported by MHash are:

• MHASH_ADLER32
• MHASH_CRC32
• MHASH_CRC32B
• MHASH_GOST
• MHASH_HAVAL128
• MHASH_HAVAL160
• MHASH_HAVAL192
• MHASH_HAVAL256
• MHASH_MD4
• MHASH_MD5
• MHASH_RIPEMD160
• MHASH_SHA1
• MHASH_SHA256
• MHASH_TIGER
• MHASH_TIGER128
• MHASH_TIGER160

The following example uses MHash to encrypt the contents of texfile.txt and write the encrypted result to encrypted.txt:

   <?php

$file = 'textfile.txt';
$initial_contents = file_get_contents($file);

if($initial_contents){

//mhash() applies a hash function specified by MHASH_MD5
//to the $initial_contents
$encrypted = mhash(MHASH_MD5, $initial_contents);

// get current Unix timestamp
$current = time();

$salt = $current;
$password = "Octavia";

//mhash_keygen_s2k generates a key according to the hash function
//given and the password provided by the user.
$hash = mhash_keygen_s2k(MHASH_GOST, $password, $salt, 20);

//concatenate the $salt with the $hash
$key = $salt . "|" . bin2hex($hash);

$encrypted_file = @fopen('encrypted.txt','w');
$ok_encrypt = @fwrite($encrypted_file,
'mhash: '.bin2hex($encrypted).'  mhash_keygen_s2k:
'.$key);

if($ok_encrypt){
echo 'The encrypted code was succesfully created '.
'in encrypted_file.txt !!!'.'<br />';
}
else{
echo ("The write of this file failed!");
}
@fclose($encrypted_file);
}
?>

Secret Keys and Crypt_Blowfish
Secret-key cryptography uses a single key for both encryption and decryption—also called a symmetric key. For example, the commonly-used DES algorithm is a secret key algorithm. The Crypt_Blowfish PEAR package is based on the Blowfish block cipher and supports two-way encryption, either with or without a secret key. The package doesn’t require MCrypt, but Crypt_Blowfish can use MCrypt if it’s installed. The latest released version is 1.0.1 (stable), and you install it like any other PEAR package:

   > pear install pear_package_name

This package uses two classes defined in the Blowfish.php file, which you must include in all scripts that use the Crypt_Blowfish package:

   require_once 'Crypt/Blowfish.php';

Here’s the code for the by-now-familiar encryption example program using Crypt_Blowfish:

   <?php

require_once 'Crypt/Blowfish.php';

$file = 'textfile.txt';
$initial_contents = file_get_contents($file);

if($initial_contents){
$bf = new Crypt_Blowfish('some secret key!');

// Encrypts a string
$encrypted = $bf->encrypt($initial_contents);

$encrypted_file = @fopen('encrypted.txt','w');
$ok_encrypt = @fwrite($encrypted_file,$encrypted);
if($ok_encrypt){
echo 'The encrypted code was succesfully created '.
'in encrypted_file.txt!!!'.'<br />';
}
else{
echo ("The write of this file failed!");
}
@fclose($encrypted_file);

// Decrypts an encrypted string
$plaintext = $bf->decrypt($encrypted);
$newfile = @fopen('newfile.txt','w');
$ok_decrypt = @fwrite($newfile,$plaintext);
if($ok_decrypt){
echo 'The decrypted code was succesfully created '.
'in newfile.txt!!!'.'<br />';
}
else{
echo ("The write of this file failed!");
}

@fclose($newfile);
}
?>

   > pear install pear_package_name

Crypt_RSA performs intensive math calculations, for which it uses one of the following extensions:

• PECL big_int extension—(requires a version greater than or equal to 1.0.3)
• PHP GMP extension
• PHP BCMath extension for PHP4/PHP5. Required because libbcmath was bundled with PHP 4.0.4.

Here’s an example of using this package:

   <?php

require_once 'Crypt/RSA.php';

//Generates the pair keys
function generate_key_pair()
{
global $public_key,$private_key;

$key_pair = new Crypt_RSA_KeyPair(32);

//Returns public key from the pair
$public_key = $key_pair->getPublicKey();

//Returns private key from the pair
$private_key = $key_pair->getPrivateKey();
}

//Check runtime errors
function check_error(&$obj)
{
if ($obj->isError()){
$error = $obj->getLastError();
switch ($error->getCode()) {
case CRYPT_RSA_ERROR_WRONG_TAIL :
// nothing to do
break;
default:
// echo error message and exit
echo 'error: ', $error->getMessage();
exit;
}
}
}

$file = 'textfile.txt';

generate_key_pair();
$plain_text = file_get_contents($file);

//get string represenation of the public key
$key = Crypt_RSA_Key::fromString($public_key->toString());

$rsa_obj = new Crypt_RSA;
check_error($rsa_obj);

//Ecnrypts $plain_text by the key $key.
$encrypted = $rsa_obj->encrypt($plain_text, $key);

$encrypted_file = @fopen('encrypted.txt','w');
$ok_encrypt = fwrite($encrypted_file,$encrypted);
if($ok_encrypt){
echo 'The encrypted code was succesfully created '.
'in encrypted_file.txt!!!'.'<br />';
}
else{
echo ("The write of this file failed!");
}
@fclose($encrypted_file);

$enc_text = $encrypted;

//Get string represenation of the private key
$key2 = Crypt_RSA_Key::fromString($private_key->toString());
check_error($key2);

//Check encrypting/decrypting function's behaviour
$rsa_obj->setParams(array('dec_key' => $key2));
check_error($rsa_obj);

//Decrypts $enc_text
$decrypted = $rsa_obj->decrypt($enc_text);

$newfile = @fopen('newfile.txt','w');
$ok_decrypt = @fwrite($newfile,$decrypted);
if($ok_decrypt){
echo 'The decrypted code was succesfully created '.
'in newfile.txt!!!'.'<br />';
}
else{
echo ("The write of this file failed!");
}
@fclose($newfile);

?>

Generating Hashes with Crypt_HMAC
The Crypt_HMAC PEAR package contains a class you can use to calculate RFC 2104-compliant hashes. Crypt_HMAC is easy to use; you need only provide your secret key, the hash method you want to use, and the plaintext string. Crypt_HMAC supports both MD5 and SHA-1 algorithms. The latest stable released version is 1.0.0. You install it just like any other PEAR package:

   > pear install pear_package_name

And here’s a simple example that creates a hash using Crypt_HMAC:

   <?php

require_once 'Crypt/HMAC.php';

//Creating a key by repeating the "0x0b" character for 20 times
$key = str_repeat(chr(0x0b), 20);

//Creating an instance of the Crypt_HMAC class
//$crypt = new Crypt_HMAC($key, 'md5');
$crypt = new Crypt_HMAC($key, 'md5');

//Hashing function
echo $crypt->hash('Hello')."<br />";

$key = str_repeat(chr(0xaa), 10);
$data = str_repeat(chr(0xdd), 50);

//Sets key to use with hash
$crypt->setKey($key);
echo $crypt->hash($data)."\n";
?>

   > pear install pear_package_name

The following two code examples show two applications for generating a secret key between two parties: subject_1 and subject_2. The first example shows you the simplest way to obtain a secure key based on Diffie Hellman algorithm:

   <?php

//include Diffie Hellman functions
require_once 'Crypt/DiffieHellman.php';

//set the required options for two subjects
$subject_1 = array('prime'=>'123', 'generator'=>'7', 'private'=>'3');
$subject_2 = array('prime'=>'123', 'generator'=>'7', 'private'=>'34');

//apply Diffie Hellman algorithm
$subject_1_GK = new Crypt_DiffieHellman(
$subject_1['prime'], $subject_1['generator'],
$subject_1['private']);
$subject_2_GK = new Crypt_DiffieHellman(
$subject_2['prime'], $subject_2['generator'],
$subject_2['private']);

//generate keys
$subject_1_GK->generateKeys();
$subject_2_GK->generateKeys();

//compute the secret keys
$subject_1_SK = $subject_1_GK->computeSecretKey(
$subject_2_GK->getPublicKey())->getSharedSecretKey();
$subject_2_SK = $subject_2_GK->computeSecretKey(
$subject_1_GK->getPublicKey())->getSharedSecretKey();

//displaying the secret keys
echo('Subject_1_SK:'.$subject_1_SK.'<br />');
echo('Subject_2_SK:'.$subject_2_SK);
?>

The second example shows you how to generate a secret key using the Diffie Hellman BINARY mode:

   <?php

//include Diffie Hellman functions
require_once 'Crypt/DiffieHellman.php';

//set the required options for two subjects
$subject_1 = array('prime' =>
'9568094558049898340935098349053',
'generator'=>'2',
'private' => '2232370277237628823279273723742872289398723');
$subject_2 = array('prime' =>
'9568094558049898340935098349053',
'generator'=>'2',
'private' => '0389237288721323987429834389298232433363463');

//apply Diffie Hellman algorithm
$subject_1_GK = new Crypt_DiffieHellman(
$subject_1['prime'], $subject_1['generator'],
$subject_1['private']);
$subject_2_GK = new Crypt_DiffieHellman(
$subject_2['prime'], $subject_2['generator'],
$subject_2['private']);

//generate keys
$subject_1_GK->generateKeys();
$subject_2_GK->generateKeys();

//compute the secret keys using BINARY mode
$subject_1_SK = $subject_1_GK->computeSecretKey(
$subject_2_GK->getPublicKey(Crypt_DiffieHellman::BINARY),
Crypt_DiffieHellman::BINARY)->
getSharedSecretKey(Crypt_DiffieHellman::BINARY);
$subject_2_SK = $subject_2_GK->computeSecretKey(
$subject_1_GK->getPublicKey(Crypt_DiffieHellman::BINARY),
Crypt_DiffieHellman::BINARY)->
getSharedSecretKey(Crypt_DiffieHellman::BINARY);

//display the secret keys
echo('subject_1_SK:'.$subject_1_SK.'<br />');
echo('subject_2_SK:'.$subject_2_SK.'<br />');

?>

With the wide variety of cryptographic options you’ve seen here, you should be able to achieve nearly anything you want. Cryptography is a delicate security problem—and as you can see there are many solutions and implementations. The information in this article can help you get started, but beyond that, only experience and hard work with secure systems will help you to choose the cryptographic implementation that represents the perfect compromise between security, speed, and implementation time.