0

I want to encrypt certain field values from webform submissions and will use webform_encrypt module to achieve this. This is dependant on encrypt module.

I am interested to know how satisfactory are the default encryption methods which are included with Encrypt module?

For encryption method settings, I am using the default settings as below

Mcrypt AES (CBC Mode) Uses PHP's Mcrypt extension and AES in CBC mode. The key MUST be 16, 24, or 32 bytes.

I am also using the Base64 decode method with the key stored in a file outside the web root.

The generated key looks like this (I have changed most of the characters)

EKEIoRp+R8de2bP4JPj7Ut==

I don't know much about this stuff and I am unsure how strong this key is? It has 24 characters. Is it therefore a 24bit key?

Are any simple methods available to use a much longer key?

Improve this question
5
  • Dang. I mis-spelt encrypt tag. Does anybody have permission to correct this?
    – MrPaulDriver
    Apr 7, 2016 at 16:16
  • Yup, I have fixed it :)
    – Neograph734
    Apr 7, 2016 at 16:20
  • 1byte = 8bits, your key is 24bytes * 8bits = 192bits (AES-192). The other AES- flavours (128 and 256) use the same maths, different key length (16 and 32 bytes respectively). Have a look at this post about AES-256 to get an idea of how secure it's considered
    – Clive ♦
    Apr 7, 2016 at 17:03
  • That's not quite right. This is base64 so you don't get the full 8 bits of entropy for each character of the encoded version, and the padding at the end doesn't count towards entropy either. If you decode the base64 (e.g. using base64 -d | wc -c) it comes out as 16 bytes or 128 bits.
    – John Morahan
    Apr 21, 2016 at 14:59
  • So if doubled the key length to something like iEKEIoRp+R8de2bP4JPj7Ut==EKEIoRp+R8de2bP4JPj7Ut== Would I have a 256 bi key?
    – MrPaulDriver
    Apr 21, 2016 at 17:27

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.