Cryptography in PHP: Encryption and Hashing — A Practical Guide

Cryptography in PHP: Data Encryption and Hashing

Web application security is one of the key tasks for a developer. PHP provides powerful built-in tools for cryptographic data protection. In this article, we will look at two main areas: encryption (transforming data with the ability to reverse it) and hashing (one-way transformation for integrity verification).

1. Hashing in PHP

Hashing is used for storing passwords, checksums, and verifying data integrity. In PHP, the password_hash() and hash() functions are used for these purposes.

1.1. Secure Password Hashing

Never use md5 or sha1 for storing passwords. Use the bcrypt algorithm via password_hash():

<?php// Hashing a password$password = 'MySecureP@ss123';$hash = password_hash($password, PASSWORD_BCRYPT, ['cost' => 12]);

echo $hash; // $2y$12$...

// Verifying a passwordif (password_verify('MySecureP@ss123', $hash)) {    echo "Password is correct!";} else {    echo "Invalid password!";}?>

The password_hash() function automatically generates a salt and uses a secure algorithm. The cost parameter adjusts the computational complexity (10-12 is recommended).

1.2. Hashing Arbitrary Data

For verifying the integrity of files or data, use SHA-256 or SHA-3 algorithms:

<?php$data = "Important data for verification";$hash_sha256 = hash('sha256', $data);$hash_sha3_256 = hash('sha3-256', $data);

echo "SHA-256: " . $hash_sha256 . PHP_EOL;echo "SHA3-256: " . $hash_sha3_256 . PHP_EOL;

// File integrity check$file_hash = hash_file('sha256', '/path/to/file.zip');echo "File hash: " . $file_hash;?>

2. Symmetric Encryption in PHP

Symmetric encryption uses a single key to encrypt and decrypt data. PHP supports OpenSSL and Sodium.

2.1. Encryption via OpenSSL (AES-256-GCM)

The recommended mode is AES-256-GCM, which provides data authentication:

<?php$data = "Secret message";$key = random_bytes(32); // 256-bit key$iv = random_bytes(12);  // 96-bit initialization vector

// Encryption$encrypted = openssl_encrypt(    $data,    'aes-256-gcm',    $key,    OPENSSL_RAW_DATA,    $iv,    $tag);

// Decryption$decrypted = openssl_decrypt(    $encrypted,    'aes-256-gcm',    $key,    OPENSSL_RAW_DATA,    $iv,    $tag);

echo "Original data: " . $data . PHP_EOL;echo "Decrypted: " . $decrypted . PHP_EOL;echo "Authentication tag: " . bin2hex($tag);?>

Important: store $key and $iv (or their combination) for decryption. The $tag verifies data integrity.

2.2. Encryption via Sodium (libsodium)

Since PHP 7.2, Sodium is part of the core. It is simpler and more secure:

<?php$data = "Confidential information";$key = sodium_crypto_secretbox_keygen(); // Key generation$nonce = random_bytes(SODIUM_CRYPTO_SECRETBOX_NONCEBYTES);

// Encryption$ciphertext = sodium_crypto_secretbox($data, $nonce, $key);

// Decryption$decrypted = sodium_crypto_secretbox_open($ciphertext, $nonce, $key);

echo "Encrypted: " . base64_encode($ciphertext) . PHP_EOL;echo "Decrypted: " . $decrypted . PHP_EOL;

// Memory cleanupsodium_memzero($key);?>

3. Asymmetric Encryption (RSA)

Asymmetric encryption uses a pair of keys (public/private). It is used for secure data transmission:

<?php// Key generation$config = [    'private_key_bits' => 2048,    'private_key_type' => OPENSSL_KEYTYPE_RSA,