Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am using phpseclib implementation AES and HMAC. But I dont know the best way to create random keys for these. What is the best way to do? Is there any built in function in phpseclib to create keys of the preferred length?

share|improve this question
up vote 2 down vote accepted

See the "Generating Keys" section of the Encryption documentation.

It suggests using the following code to generate a random key:

$key = \phpSec\Crypt\Rand::bytes(32);

For the sourceforge project, it appears that if you want a password-derived key, then you can use ->setPassword() on the Crypt_AES object. However, the only generation of random data that I could find is the generation of a random number. That is done through the crypt_random function. I would suggest just taking the necessary functions out of the other phpSecLib. As it is MIT-licensed, this shouldn't be a problem from a license point of view.

share|improve this answer
As it seems there are many php sec libraries. The one that I am talking about is – Anuroop Kuppam Jan 28 '13 at 22:58
First, when people talk about phpseclib they're probably talking about the "sourceforge" version. First ten sites on Google are for that version anyway. Second, the "sourceforge" version has been hosted on github since last year: . Check out vs. – neubert Jan 29 '13 at 15:58
ohh! thank you. – Anuroop Kuppam Jan 30 '13 at 10:22

I woulds suggest using crypt_random_string. It's not in the 0.3.1 release but it is in the latest Git version.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.