Data encryption

[neo_philiac]

OK. So what I am working on is a simple online form submission with php. The form contains info like phone numbers, address etc. I am saving these information in a text file for future access. I must create .doc file from each form submission which is now being done simply writing to doc file. Of course this is no way to secure any data here. I cannot use a database. But I need to secure this data. What would be the best way to do it? How can I encrypt this data and then decrypt it ?

[NXArmada]

First I suggest you check out the PHP website http://www.php.net

second look here: http://www.onlamp.com/pub/a/php/2001/07/26/encrypt.html

[neo_philiac]

OK , So I encrypt the data using Mcrypt with a key. But anyone who has access to the encrypted data and the key can decipher it ? Am I wrong ? If so , what do I do?

[ksather]

Try using md5() hash function. it will convert any string supplied into a 128bit, 32 charcter string. If a hacker gots the string data it would look something like "434s323498f83748394827c22.." and becasue it is a one-way encryption it is not going to do much good for the hacker.

here is a sample of using md5() for using a password but can be used for anything.


<?php
$password = "mypassword";
$encrypted_password = md5($password); //encrypting the password using md5()

echo "Un-encrypted Password: $password";
echo "Encrypted Password: $encrypted_password";
?>


Hope this helps out.

ksather

[neo_philiac]

Thank you very much guys BUT I need to decrypt the message. As far as I know md5 hashes are one way hashes. Any idea? I know I can use mcrypt ! But any other options ? Also very stupid question I know you can not see the php code by looking at the source for that page but what if someone tries to hack into the page and look at my pass phrase for mcrypt then the hacker can decrypt my messages. What are the chances for that?

[Twey]

There's only one way to get around the problem of somebody having access to your server: require all users to supply a passphrase, which is then used as part of the key to encrypt and decrypt the data. Of course, the attacker can still modify your server to collect the passphrases and store them somewhere (if someone gets access to your server you're in big trouble no matter what you do), but it's considerably slower and more awkward, and will hopefully give your sysadmin a better chance to spot them.

[neo_philiac]

OK so I encrypt the data with mcrypt and then save the data in individual txt files (encrypted data). Now I want to see the decrypted data BUT I want to decrypt the data by reading from the file and then create a doc file and then download the doc file without saving the doc file on the server in one shot. I know how to encrypt and decrypt data but what about the rest of the stuff (decrypt to a doc file and download it without saving)

Thanks

[neo_philiac]

Thank you very much. OK maybe I dont know how to encrypt and decrypt!

I have two php scripts one encrypts and the other decrypts

<?php

// Designate string to be encrypted
$string = "Applied Cryptography, by Bruce Schneier, is a wonderful cryptography reference.";

// Encryption/decryption key
$key = "Four score and twenty years ago";

// Encryption Algorithm
$cipher_alg = MCRYPT_RIJNDAEL_128;

// Create the initialization vector for added security.
$iv = mcrypt_create_iv(mcrypt_get_iv_size($cipher_alg, MCRYPT_MODE_ECB), MCRYPT_RAND);

// Output original string
print "Original string: $string <p>";

// Encrypt $string
$encrypted_string = mcrypt_encrypt($cipher_alg, $key, $string, MCRYPT_MODE_CBC, $iv);

// Convert to hexadecimal and output to browser
print "Encrypted string: ".bin2hex($encrypted_string)."<p>";

print "Decrypted string: $decrypted_string <p>";

?>

the other


Reads the file where the encrypted data is saved and then tries to decrypt it :

<?php

// Designate string to be encrypted
$string = "Applied Cryptography, by Bruce Schneier, is a wonderful cryptography reference.";

// Encryption/decryption key
$key = "Four score and twenty years ago";

// Encryption Algorithm
$cipher_alg = MCRYPT_RIJNDAEL_128;

// Create the initialization vector for added security.
$iv = mcrypt_create_iv(mcrypt_get_iv_size($cipher_alg, MCRYPT_MODE_ECB), MCRYPT_RAND);

// Output original string
$lines = file('data.txt');

// Loop through our array, show HTML source as HTML source; and line numbers too.
foreach ($lines as $line_num => $line) {
	
	$decrypted_string = mcrypt_decrypt($cipher_alg, $key, $line, MCRYPT_MODE_CBC, $iv);

    echo "Line #<b>{$line_num}</b> : " . $decrypted_string . "<br />\n";
}
?>

I understand that everytime I encrypt the data its not the same. But how do I get the data back ?

[neo_philiac]

Also can we use mcrypt in php to encrypt a file?