I want to encrypt certain field values from webform submissions and will use webform_encrypt module to achieve this. This is dependant on encrypt module.

I am interested to know how satisfactory are the default encryption methods which are included with Encrypt module?

For encryption method settings, I am using the default settings as below

Mcrypt AES (CBC Mode) Uses PHP's Mcrypt extension and AES in CBC mode. The key MUST be 16, 24, or 32 bytes.

I am also using the Base64 decode method with the key stored in a file outside the web root.

The generated key looks like this (I have changed most of the characters)


I don't know much about this stuff and I am unsure how strong this key is? It has 24 characters. Is it therefore a 24bit key?

Are any simple methods available to use a much longer key?

  • Dang. I mis-spelt encrypt tag. Does anybody have permission to correct this? – MrPaulDriver Apr 7 '16 at 16:16
  • Yup, I have fixed it :) – Neograph734 Apr 7 '16 at 16:20
  • 1byte = 8bits, your key is 24bytes * 8bits = 192bits (AES-192). The other AES- flavours (128 and 256) use the same maths, different key length (16 and 32 bytes respectively). Have a look at this post about AES-256 to get an idea of how secure it's considered – Clive Apr 7 '16 at 17:03
  • That's not quite right. This is base64 so you don't get the full 8 bits of entropy for each character of the encoded version, and the padding at the end doesn't count towards entropy either. If you decode the base64 (e.g. using base64 -d | wc -c) it comes out as 16 bytes or 128 bits. – John Morahan Apr 21 '16 at 14:59
  • So if doubled the key length to something like iEKEIoRp+R8de2bP4JPj7Ut==EKEIoRp+R8de2bP4JPj7Ut== Would I have a 256 bi key? – MrPaulDriver Apr 21 '16 at 17:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.