We replaced Mcrypt with OpenSSL for encrypting and decrypting passwords that are stored in a DB. These are the new functions we are using:
function encrypt_openssl_password($key, $pwd)
{
$cipher="AES-256-CBC";
$ivlen = openssl_cipher_iv_length($cipher);
$iv = openssl_random_pseudo_bytes( $ivlen );
$encrypted = base64_encode(
$iv .
openssl_encrypt(
$pwd,
$cipher,
hash('sha256', $key, true),
OPENSSL_RAW_DATA,
$iv
)
);
return $encrypted;
}
function decrypt_openssl_password($key, $str)
{
$data = base64_decode($str);
$cipher="AES-256-CBC";
$ivlen = openssl_cipher_iv_length($cipher);
$iv = substr($data, 0, $ivlen);
$decrypted = rtrim(
openssl_decrypt(
base64_encode(substr($data, $ivlen)),
$cipher,
hash('sha256', $key, true),
OPENSSL_ZERO_PADDING,
$iv),
"\0"
);
return $decrypted;
}
The problem:
When we decrypt an old password (that was encrypted with Mcrypt) the correct value is returned string(12) "password2019" using the new OpenSSL function.
When we now store the exact same password with the new OpenSSL function, we are receiving a wrong value string(16) "password2019"
Since decryption of old passwords is working, we assume there is a glitch in the encrypt_openssl_password function. Any ideas?
