-1

I've been playing around with php mcrypt over the weekend with AES used to encrypt text strings with a key.
Later I worked up a tiny php tool to encrypt / decrypt your strings with AES/mcrypt now when the key is "wrong" and the text doesn't get decrypted, you end up with what I think is binary from what I've read around (https://i.stack.imgur.com/e5iXP.png), is there anyway in PHP to check if the variable holds binary or a properly decoded string?

My apologies if the title and the intro are a bit misleading.

Artjom B.
  • 61,146
  • 24
  • 125
  • 222
Arjit Chaudhary
  • 31
  • 1
  • 6
  • Of course there is a way. You should post the code you have tried, that way we can see where improvements are needed. –  Jan 06 '15 at 15:00
  • I've found is_binary() so far but that seems to be introduced in PHP 6.0, I'll probably be compiling that if there's no work around in earlier PHP versions. – Arjit Chaudhary Jan 06 '15 at 15:14

1 Answers1

0

When you encrypt text and then try to decrypt it, you will get the same text, but when you try to decrypt random data, there is a small chance that the result will be text (decreasing with length of data). You haven't specified what kind of data we are talking about, but determining if the decryption is successful by applying a heuristic is a bad idea. It is slow and may lead to false positives.

You should have a checksum or something like that to determine if the decrypted result is valid. This could be easily done by running sha1 on the plaintext data, prepend the result to the text and encrypt it as a whole. When you decrypt it, you can split (sha1 output has a fixed size, so you know where to split) the resulting string run sha1 on the text part and compare with the hash part. If it matches you have a valid result. You can of course improve the security a little by using SHA-256 or SHA-512.

That's is just one way of doing it, but might not be the best. Better ways would be to use an authenticated mode of operation for AES like GCM or CCM, or use encrypt-then-MAC with a good MAC function like HMAC-SHA512.

With using the approaches above you're free to use any kind of data to encrypt, because you're not limited to determining if it is text or not anymore.

Community
  • 1
  • 1
Artjom B.
  • 61,146
  • 24
  • 125
  • 222