Cryptography in PHP: Encryption and Hashing

Cryptography in PHP: Data Encryption and Hashing

\n\n

In modern web development, data security is not an option but a mandatory requirement. PHP provides a powerful arsenal of tools for cryptographic protection, divided into two main areas: encryption (reversible data transformation) and hashing (irreversible transformation). In this article, we will look at the key PHP libraries and functions for both tasks with practical examples.

\n\n

1. Basic Concepts of Cryptography in PHP

\n\n

Before moving to the code, it is important to distinguish between two types of operations:

Encryption — transforming data with the ability to restore the original text if you have the key. Used for transmitting confidential information.
Hashing — a one-way transformation where restoring the original data is impossible. Used for storing passwords and integrity verification.

\n\n

PHP uses the openssl extension (for encryption) and password_hash/hash (for hashing).

\n\n

2. Data Encryption in PHP

\n\n

2.1. Symmetric Encryption (AES)

\n\n

The most popular algorithm is AES-256-GCM, which provides high performance and built-in authentication.

\n\n

<?php\n// Encryption\n$data = "Secret message";\n$key = openssl_random_pseudo_bytes(32); // 256-bit key\n$iv = openssl_random_pseudo_bytes(12);  // 96-bit vector for GCM\n\n$encrypted = openssl_encrypt(\n    $data,\n    'aes-256-gcm',\n    $key,\n    OPENSSL_RAW_DATA,\n    $iv,\n    $tag\n);\n\n// Encode to base64 for transmission\n$encrypted_base64 = base64_encode($iv . $tag . $encrypted);\n\n// Decryption\n$decoded = base64_decode($encrypted_base64);\n$iv = substr($decoded, 0, 12);\n$tag = substr($decoded, 12, 16);\n$ciphertext = substr($decoded, 28);\n\n$decrypted = openssl_decrypt(\n    $ciphertext,\n    'aes-256-gcm',\n    $key,\n    OPENSSL_RAW_DATA,\n    $iv,\n    $tag\n);\n\necho "Decrypted: " . $decrypted; // Secret message\n?>

\n\n

Important: Never use ECB mode — it is insecure. Always use GCM or CBC with HMAC.

\n\n

2.2. Asymmetric Encryption (RSA)

\n\n

RSA is used for key exchange and digital signatures. PHP uses a pair of keys (public/private).

\n\n

<?php\n// Key generation\n$config = [\n    "private_key_bits" => 2048,\n    "private_key_type" => OPENSSL_KEYTYPE_RSA,\n];\n$res = openssl_pkey_new($config);\nopenssl_pkey_export($res, $privateKey);\n$publicKey = openssl_pkey_get_details($res)['key'];\n\n// Encryption with public key\n$data = "Confidential data";\nopenssl_public_encrypt($data, $encrypted, $publicKey);\n\n// Decryption with private key\nopenssl_private_decrypt($encrypted, $decrypted, $privateKey);\n\necho $decrypted; // Confidential data\n?>

\n\n

3. Password Hashing

\n\n

Password hashing is a critically important task. PHP provides specialized functions that automatically handle salt and computation cost.

\n\n

3.1. bcrypt (Recommended by Default)

\n\n

The password_hash() function with the PASSWORD_BCRYPT algorithm creates a secure hash with automatic salting.

\n\n

<?php\n$password = "UserPassword123!";\n\n// Hashing\n$hash = password_hash($password, PASSWORD_BCRYPT, ['cost' => 12]);\necho "Hash: " . $hash . "\\n"; // $2y$12$...\n\n// Verification\nif (password_verify($password, $hash)) {\n    echo "Password is correct!";\n} else {\n    echo "Invalid password";\n}\n\n// Check if rehashing is needed\nif (password_needs_rehash($hash, PASSWORD_BCRYPT, ['cost' => 12])) {\n    $newHash = password_hash($password, PASSWORD_BCRYPT, ['cost' => 12]);\n}\n?>

\n\n