Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I hope this is the appropriate audience for my question. I'm rewriting a legacy PHP web application that makes heavy use of MCrypt. It's on a shared host and handles payment data as well as personally identifiable information.

What is a suitable replacement, if any, besides OpenSSL?

share|improve this question

migrated from Jun 19 '14 at 12:29

This question came from our site for software developers, mathematicians and others interested in cryptography.

This question probably fits better on stackoverflow, since this site is more about theoretical crypto. – Edvard Fagerholm Jun 19 '14 at 10:26
If by payment data, you mean credit card numbers, you'll need to comply which PCI-DSS, which is a pain. The general recommendation is to never let those touch your server, using a PSP instead that receives the CC number and replaces it by an opaque token before it's sent to your server. – CodesInChaos Jun 19 '14 at 11:48
For the connection itself you must use HTTPS/SSL/TLS. mcrypt is mainly for encrypting data at test, but since you need to store the key where it can be accessed by your web application, the practical security gain is rather small. – CodesInChaos Jun 19 '14 at 11:50
This isn't about cryptography. It's either about designing a security system involving crypto, in which case it'd fit Information Security or it's about implementing it, belonging on Stack Overflow. – CodesInChaos Jun 19 '14 at 11:52

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.