What is the fastest combination of compression + encoding + checking + serialization of an array?

Question

I need a combination of functions that does:

array serialization(no object, small - 3-7 key-value pairs of strings, no references)
data validity check of above(Is it better for the hash to be inside the array?)
encryption of above(is there any encryption method that validates decrypted information?)
compression of above(I am not sure if the cost worth: bandwidth / CPU time)

...of an array.

Everything should be optimized for speed.

For serializing the array I was thinking about using json_encode() rather than serialize() because it's faster. See Preferred method to store PHP arrays (json_encode vs serialize).

For data validity check I was thinking about using sha1(), but I am considering crc32 because it's faster and I don't think collisions are close. See Fastest hash for non-cryptographic uses?.

For encryption i made:

<?php

function encode($pass, $data) {
  return mcrypt_encrypt(MCRYPT_RIJNDAEL_256, $pass, $data, MCRYPT_MODE_ECB);
}

function decode($pass, $data) {
  return mcrypt_decrypt(MCRYPT_RIJNDAEL_256, $pass, $data, MCRYPT_MODE_ECB);
}

$rand = str_repeat(rand(0, 1000), 5);

$start = microtime(true);
for($i = 0; $i <= 10000; $i++){
  encode('pass', $rand);
}

echo 'Script took ' . (microtime(true) - $start) . ' seconds for encryption<br/>';

$start = microtime(true);
for($i = 0; $i <= 10000; $i++){
  encode('pass', $rand);
}

echo 'Script took ' . (microtime(true) - $start) . ' seconds for decryption';

Results are:

Script took 1.8680129051208 seconds for encryption
Script took 1.8597548007965 seconds for decryption

I would rather avoid any randomness. I know that CBC mode is more secure, but it is also slower.

For compression I have no idea what is better to use given the fact that the resulting string is binary and short.

Is there any compression that don't require encoding in order to set the resulting string as a cookie? I know that sha1() for example returns only digits ans letters.

It is a complex question. So feel free to point anything wrong or not accurate. It contains many topics but basically the short question is how to safely and rapidly encrypt/decrypt an array while having a small representation of it.

Is this the right order?

Is data validation required given that there is a high probability that the resulting JSON won't be valid in case data is altered?

Is there a function that already combines those or some of those functions?

Why not store session data on the server side and just recall it as needed? That would save the whole need to have an encrypted cookie. — afuzzyllama, Jan 25 '12 at 16:10
I will create another question on that and link. It is a different topic. The idea is to avoid Memcached, NFS, session databases or session servers. — Aalex Gabi, Jan 25 '12 at 22:08

score 3 · Accepted Answer · answered Jan 25 '12 at 16:44

I know that CBC mode is more secure, but it is also slower

Than ECB? Only if the data is more than a couple of blocks.

If you want the fastest encryption algorithm then there's no substitute for testing it yourself - somewhat strangely, PHP's sha1() implementation is significantly faster than its md5() (I know these are hashes - this is to illustrate that performance depends on implementation as much as algorithm).

Why are you trying to valdate it? If it's an encrypted datagram then the contents are opaque to the user - if they try tampering with it, then it will most likely to fail to decompress, in the unlikely event it still decompresses then decode will fail but in the remote case that this neither happen it should be very easy to check for other modifications - even an embedded CRC32 seems overkill.

in order to set the resulting string as a cookie

Sounds like you're using lots of fancy encryption to cover up a basic insecurity of your application - it's likely to be open to replay attacks. And you've got the added complication of ensuring that your data fits in a cookie. Why not just use a server-side session with a random value sent client-side (you don't have to use the PHP session handler if you want to implement a remember me type function and still have a conventional session).

You are right about compression failing in case data being altered. About the cookie think: this is not covering up insecurity. Basicly the cookie itself would be the session. The point is not using sessions(and suite Memcached/server session). The application of this is another discution. PHP issues an ugly notice when using CBC without an initial vector. — Aalex Gabi, Jan 25 '12 at 16:56
I think you are right implementations could be different in PHP. I am going to do some research and I'll come back with some stats. — Aalex Gabi, Jan 26 '12 at 23:43

score 0 · Answer 2 · answered Jan 25 '12 at 16:57

0

In my opinion it would be sufficient to use only a compression. To reverse engineer a compression it would take a long time. I can recommend a huffman compression.

answered Jan 25 '12 at 16:57

Micromega

12,486
7
35
72

It also takes a long time to forward engineer one. Unless you use an existing one. But then it won't take as long to reverse engineer. – President James K. Polk Jan 25 '12 at 22:58
@GregS: Especially one that works with the different browsers and 7-bit charset. I use it in hidden fields and to download the current engine state. – Micromega Jan 25 '12 at 23:06

What is the fastest combination of compression + encoding + checking + serialization of an array?

2 Answers2