I am really lost in this subject, I find it hard to get any reliable documentation on the subject that is a bit friendly for beginners like me. So I apologize in advance if this question would sound nonsensical.
Anyway, I am implementing encryption in a project using
php openssl_encrypt. So far this is what I have:
// encrypt $dataToEncrypt = 'Hello World'; $cypherMethod = 'AES-256-GCM'; $key = random_bytes(32); $iv = random_bytes(openssl_cipher_iv_length($cypherMethod)); $encryptedString = openssl_encrypt($dataToEncrypt, $cypherMethod, $key, $options=0, $iv, $tag);
And then I store
// decrypt $decryptedString = openssl_decrypt($encryptedString, $cypherMethod, $key, $options=0, $iv, $tag);
My questions are:
Is there anything wrong with my current implementation?
$keybe randomly generated or should I use a single secret key for general use? I am asking this because in some examples I see around the web they are using text strings for the
$key. If it is not required for the
$keyto be random, does it have any improvements to security if it is random?
$tagthe message authentication code (MAC)? In the PHP documentation it states:
The authentication tag passed by reference when using AEAD cipher mode (GCM or CCM).
$tag is the MAC, then does that mean that
PHP openssl_decrypt is also handling the authentication process?
Thanks for any help!