# Why does Laravel only support AES-256-CBC?

Modern Laravel uses OpenSSL to provide AES-256-CBC encryption along with a MAC. However, I was under the impression that this is not a particularly secure approach.

• Why does Laravel only support AES-256-CBC?

While I'm not using this feature for sensitive data, I'd still like to follow best practices.

• Oddly, the Encrypter source seems to indicate the default is AES-128-CBC -> public function __construct($key,$cipher = 'AES-128-CBC'). – puzzlepalace Feb 11 at 20:11
• Another thing to note is that the IV used to encrypt in CBC mode is also the key for the HMAC computation on the ciphertext. – puzzlepalace Feb 11 at 20:16

Well, this may not be a good answer but also long to be a comment. The following quotes from LaravelAEAD

This package replaces, when installed and enabled, the default encryption implementation of Laravel, which currently supports only two variants of the same block cipher, AES-128-CBC and AES-256-CBC.

The reason for only having two options is probably based on PHP history itself, like the (not so much) recent depreciation of MCrypt.