Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I hope this is the appropriate audience for my question. I'm rewriting a legacy PHP web application that makes heavy use of MCrypt. It's on a shared host and handles payment data as well as personally identifiable information.

What is a suitable replacement, if any, besides OpenSSL?

share|improve this question

migrated from crypto.stackexchange.com Jun 19 at 12:29

This question came from our site for software developers, mathematicians and others interested in cryptography.

This question probably fits better on stackoverflow, since this site is more about theoretical crypto. –  Edvard Fagerholm Jun 19 at 10:26
If by payment data, you mean credit card numbers, you'll need to comply which PCI-DSS, which is a pain. The general recommendation is to never let those touch your server, using a PSP instead that receives the CC number and replaces it by an opaque token before it's sent to your server. –  CodesInChaos Jun 19 at 11:48
For the connection itself you must use HTTPS/SSL/TLS. mcrypt is mainly for encrypting data at test, but since you need to store the key where it can be accessed by your web application, the practical security gain is rather small. –  CodesInChaos Jun 19 at 11:50
This isn't about cryptography. It's either about designing a security system involving crypto, in which case it'd fit Information Security or it's about implementing it, belonging on Stack Overflow. –  CodesInChaos Jun 19 at 11:52

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.