How to correctly encrypt data with proper authentication using AES-256-CBC in php?

Question

I have been using the openssl function for encrypting data with AES-256-CBC in php. I have been able to encrypt it using an unique IV (by generating with openssl_random_pseudo_bytes)for each new encryption.

But I am struggling with the idea of authenticated encryption with aes cbc. How do I basically authenticate when I am about to decrypt the data?

Do I need to use something like PBKDF2, blowfish or hash_hmac()?

Do I need to hash the key somehow?

Any help is extremely appreciated.

Answer 1

Basically you would be constructing an AEAD scheme. You will need to perform HMAC over the IV, the ciphertext and possibly over additional associated data (AAD). If you just need to authenticate the ciphertext then you may simply leave out (or leave empty) the AAD - but not the IV during the HMAC function.

Fortunately somebody already thought about standardizing this, so you may simply copy this draft RFC called " Authenticated Encryption with AES-CBC and HMAC-SHA". Obviously having a draft RFC is less optimal than a full RFC with a lot of research, but at least it has undergone some evaluation. It basically formalizes something that already existed in the first place.

Notes:

• The RFC seems to have been written with TLS 1.3 in mind, but as TLS 1.3 deliberately leaves old style algorithms behind, it seems to have been mostly ignored;
• This scheme uses encrypt-then-MAC, it doesn't hurt to understand the differences with MAC-then-encrypt and encrypt-and-MAC.