3 typo fix in title
| link

Is phpseclib a secure and reliabelreliable alternative to OpenSSL?

    Tweeted twitter.com/#!/StackSecurity/status/399638031663398913
2 added 118 characters in body
source | link

I know that OpenSSL needs to be installed and activated via apache and the config files, which can be cumbersome or even impossible, and that phpseclib is more flexible and easier to handle than OpenSSL (X.509 problem/ in certain situations the PHP implementation of OpenSSL needs a X.509 certificate in order to create a valid keypair), so i'd like to use phpseclib instead of OpenSSL.

BUT, and this is the question, is it really a viable alternative securitywise? Isn't it problematic to have its source code lying around on the server? Are there some negative secucity implications using phpseclib, or any php implementation of RSA for that matter?

Situation:

  • OpenSSL: +native +binary -less flexible -less versatile -sometimes config problems
  • phpseclib: +flexible +portable +more versatile -non native -not compiled

Question:

  • Security?

EDIT: Security?I use OpenSSL to create a keypair and then encrypt data directly to the DB (client request, no way around it). But the question here is a general one, independent of the final application.

I know that OpenSSL needs to be installed and activated via apache and the config files, which can be cumbersome or even impossible, and that phpseclib is more flexible and easier to handle than OpenSSL (X.509 problem), so i'd like to use phpseclib instead of OpenSSL.

BUT, and this is the question, is it really a viable alternative securitywise? Isn't it problematic to have its source code lying around on the server? Are there some negative secucity implications using phpseclib, or any php implementation of RSA for that matter?

Situation:

  • OpenSSL: +native +binary -less flexible -less versatile -sometimes config problems
  • phpseclib: +flexible +portable +more versatile -non native -not compiled

Question: Security?

I know that OpenSSL needs to be installed and activated via apache and the config files, which can be cumbersome or even impossible, and that phpseclib is more flexible and easier to handle than OpenSSL (X.509 problem/ in certain situations the PHP implementation of OpenSSL needs a X.509 certificate in order to create a valid keypair), so i'd like to use phpseclib instead of OpenSSL.

BUT, and this is the question, is it really a viable alternative securitywise? Isn't it problematic to have its source code lying around on the server? Are there some negative secucity implications using phpseclib, or any php implementation of RSA for that matter?

Situation:

  • OpenSSL: +native +binary -less flexible -less versatile -sometimes config problems
  • phpseclib: +flexible +portable +more versatile -non native -not compiled

Question:

  • Security?

EDIT: I use OpenSSL to create a keypair and then encrypt data directly to the DB (client request, no way around it). But the question here is a general one, independent of the final application.

1
source | link

Is phpseclib a secure and reliabel alternative to OpenSSL?

I know that OpenSSL needs to be installed and activated via apache and the config files, which can be cumbersome or even impossible, and that phpseclib is more flexible and easier to handle than OpenSSL (X.509 problem), so i'd like to use phpseclib instead of OpenSSL.

BUT, and this is the question, is it really a viable alternative securitywise? Isn't it problematic to have its source code lying around on the server? Are there some negative secucity implications using phpseclib, or any php implementation of RSA for that matter?

Situation:

  • OpenSSL: +native +binary -less flexible -less versatile -sometimes config problems
  • phpseclib: +flexible +portable +more versatile -non native -not compiled

Question: Security?