2

We are doing some summer clean up on our code base.

We have found we are using both openssl (openssl_ ... functions) and mcrypt (mcrypt_ ... functions) for some light weight encryption.

I am by no means an expert on encryption, but both our openssl and mcrypt use appears to be AES-256.

Since we are in the process of removing a number of unused / redundant extensions (php extensions that is)... We would like to remove either mcrypt or openssl.

What one is recommended? Should we convert everything over to openssl or mcrypt?

Encryption / decryption takes place in about 0.5-1% of requests. We would prefer whatever one of the two is faster.

Thanks!

anonymous-one
  • 14,454
  • 18
  • 60
  • 84
  • Also see [Upgrading my encryption library from Mcrypt to OpenSSL](http://stackoverflow.com/q/43329513/608639) and [Preparing for removal of Mcrypt in PHP 7.2](http://stackoverflow.com/q/42696657/608639) – jww Apr 21 '17 at 17:49

1 Answers1

2

I don't know if openssl is faster (I'd think so, because it's an extremely optimized library). But openssl is much more powerful. If you could need some additional function in the near future (RSA for example or certificates) you'll need openssl. If you now decide to migrate to mcrypt, you'd need to migrate again.

Therefor I'd recommend openssl.

K. Biermann
  • 1,295
  • 10
  • 22