Can anyone explain how to encrypt id using eloquent.Present i am using thirdparty library to encrypt and decrypt id.I want know how to encrypt and decrypt ids using eloquent orm in slim.
Asked
Active
Viewed 362 times
0
-
Is `id` the primary key in your table? – Jonas Staudenmeir Mar 22 '18 at 13:58
-
@JonasStaudenmeir i have both primary key and foreign key.I want encryptions for those while fetching or on passing – Lll ll Mar 26 '18 at 06:41
-
Why do you want to encrypt them? – Jonas Staudenmeir Mar 26 '18 at 11:24
-
for security purpose – Lll ll Mar 26 '18 at 11:30
-
Can you give more details? Are your ids integers? – Jonas Staudenmeir Mar 26 '18 at 11:34
-
yeah integer @JonasStaudenmeir – Lll ll Mar 26 '18 at 11:36
1 Answers
-1
Encrypting ids is a terrible idea. It doesn't provide any security and is bad for performance.
Encryption is only meant for sensitive data (e.g. credit card numbers). Ids are just unique identifiers and don't contain any sensitive information (or least shouldn't). If you need an identifier for a private URL, generate a random token and store it in a separate column.
Encrypting an integer with Laravel gives you a string with ~190 characters. You shouldn't use that as a primary/foreign key.
Since Laravel's encrypter uses CBC Mode, encrypting the same value gives you a different result each time. So you can't use Model::find($id) to retrieve an entry from the database. You would have to fetch and decrypt all ids to find the right one.
Jonas Staudenmeir
- 24,815
- 6
- 63
- 109
-
Encrypting IDs is an *excellent* idea, providing near-perfect security for your sensitive ID sequence, and better than generating a random token because you can produce something shorter that doesn’t require any extra storage and is immune to collisions; as for performance, the cost of, say, encrypting a single 64-bit ID with a Speck64/128 block cipher, is completely negligible—almost certainly faster than your separate token with its extra code, data and index. Laravel’s built-in encryption stuff may not be suitable, but that doesn’t mean encryption is unsuitable. – Chris Morgan Jun 12 '22 at 18:39