0

I'm building a quick site with CodeIgniter and currently I'm making use of the CI 'encrypt' library. Reading through here it sounds like I just throw on a quick:

$this->encrypt->encode($secret_data);

and do this when you want to use it:

$this->encrypt->decode($encripted_string);

Then the magic of CI and Mcrypt do the rest.

Well I'm not sure I can sleep without knowing what is going on in the background. So I have two questions...

  1. How is this working? Or is there a good resource to explain to me how this is working that I can read up on it?

  2. Is this generally thought of as a safe way to encrypt data? If not where else should I be looking.

Scott Arciszewski
  • 33,610
  • 16
  • 89
  • 206
Miles
  • 764
  • 2
  • 11
  • 20
  • 1
    The CodeIgniter Encryption Class provides two-way keyed encoding using XOR Hashing and Mcrypt. Check in system -> libraries for the encrypt.php file and descover what the class does.... – Vickel Mar 22 '16 at 18:44
  • The best resource that explains how its working is the source ([old](https://github.com/bcit-ci/CodeIgniter/blob/develop/system/libraries/Encrypt.php) and [new](https://github.com/bcit-ci/CodeIgniter/blob/develop/system/libraries/Encryption.php)). It is code with small bite size (easy to understand) and documented functions. – Artjom B. Mar 22 '16 at 20:44
  • Question 1 is off-topic, because you're asking for an off-site resource. Question 2 is somewhat opinion-based. You would need to define your security margin for question 2. – Artjom B. Mar 22 '16 at 20:46

2 Answers2

5

You're reading the "wrong" thing ...

The CodeIgniter documentation on EllisLab's website is outdated and no longer the official one. It's also for CodeIgniter 2.x, which is itself no longer supported.

The official documentation is on codeigniter.com, and you should be using CodeIgniter 3.x, which deprecates that old CI_Encrypt library and replaces it with a new one, which is far better and more well-documented, here:

http://www.codeigniter.com/userguide3/libraries/encryption.html

Narf
  • 14,600
  • 3
  • 37
  • 66
1

1. How is it working:

codeigniter 2.x

The CodeIgniter Encryption Class provides a two-way keyed encoding using XOR Hashing and Mcrypt.

interesting about XOR Hashing: https://stackoverflow.com/a/27952689/2275490

the php manual about Mcrypt: http://php.net/manual/en/book.mcrypt.php

Also you might want to check in system->libraries for the encrypt.php file and discover what it does.

codeigniter 3.x

Provides two-way keyed encoding using Mcrypt

the php manual about Mcrypt: http://php.net/manual/en/book.mcrypt.php the CI manual: http://www.codeigniter.com/userguide3/libraries/encryption.html

2. thought as safe way to encrypt data:

that's opinion based, I think definitely yes for a "quick site"

Community
  • 1
  • 1
Vickel
  • 7,879
  • 6
  • 35
  • 56
  • Thanks for being willing to delve into opinion. I know asking for it is a risky proposition, but sometimes it's useful to get other's opinions. – Miles Mar 22 '16 at 20:26
  • **No**, [CI_Encrypt](https://github.com/bcit-ci/CodeIgniter/blob/develop/system/libraries/Encrypt.php) uses AES through Mcrypt by default. There is no "XOR Hashing" going on in there (yes, there is key hashing with XOR, but is not like the answer you linked to). – Artjom B. Mar 22 '16 at 20:41