Using all the knowledge I could find on the internet I came up with a salt openssl encrypt and decrypt function. It works 90% of the time but every once in a wile the decrypt returns wither an empty sting or random bytes that have nothing to do with the encrypted data. The code I'm using is:
function Encrypt($subject, $method, $saltLength, $key){
if($method==0){
$salt=random_bytes($saltLength);
$key=hash('sha256', $salt.$key);
$iv=random_bytes(16);
$encrypt=base64_encode(openssl_encrypt($subject, 'aes-256-ctr', $key, 0, $iv));
$return=base64_encode("$method:$salt:$iv:$encrypt");
}
return($return);
}
function Decrypt($subject, $key){
$components = explode( ':', base64_decode($subject));
$method=$components[0];
if($method==0){
$salt=$components[1];
$key = hash('sha256', $salt.$key);
$iv=$components[2];
$encrypt=base64_decode($components[3]);
$return=(openssl_decrypt($encrypt, 'aes-256-ctr', $key, 0, $iv));
}
return($return);
}
$testE=Encrypt('Test', 0, 20, 'Key0');
var_dump($testE);
echo('<br><br>');
$testD=Decrypt($testE, 'Key0');
var_dump($testD);
echo('<br><br>');
$testD=Decrypt($testE, 'Key0');
var_dump($testD);
echo('<br><br>');
And an example of the faulty results for this code would be:
string(72) "MDrVsJAIE8OFjyM6y5dt+xkij5m/rTrHTnzeWs0IRrTKvNR1L7wfOmJrSlNRWFIzUFQwPQ=="
string(1) "�"
string(1) "�"
Or the return of a completely empty string:
string(72) "MDrQ+5c83vJXnva1OjrbJ2RWGjU5ajrwCn+qCneIIOqh48Gt0JmbOllsZFVUMHRuUFQwPQ=="
string(0) ""
string(0) ""
The reason I did the decrypt twice is to see if the fault is in the decrypt or the encrypt, the results clearly show that the encrypt is faulty in some way.
My question is what is causing this faulty encryption of the data? & can I improve this method and make it even more secure ?