0

I am trying to create a 2 way encryption function using PHP.

As yet I do not have a very good system at all, it is severely flawed and highly insecure, it is using a substitute cipher running from the periodic table of elements (this is not what want, but what I am working on making better).

My question is as follows:

What is the best way to create a symmetric key algorithm that both creates a salt for a string to be encrypted with and a decrypt function using the same salt and algorithm that is safe, secure and maintainable? What do I have to look out for that creates a weakness/vulnerability within the code/crypto function?

For what I have now, please see this question on codereview.stackexchange.

Notes:

  • This is not going to be used as a "rolled out" product, it is purely for training and development purposes
  • I understand that this may very well be off topic, if so please say and I'll remove this question

closed as too broad by WhiteWinterWolf, ThoriumBR, Steffen Ullrich, John Deters, Xander Jan 8 '16 at 14:30

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • Just letting you know that StackExchange also has a site dedicated to Cryptography which may be a good choice for such training question. However, I fear that stated as it is now ("What is the best way? What do you I have to look out?") it may be seen as too broad, better ask on advises on how to solve precise issues you are encountering now, or maybe on list of properties and tests you can use to determine your hash function quality, etc. – WhiteWinterWolf Jan 8 '16 at 10:53
  • 1
    @WhiteWinterWolf, thank you for that, I will rethink my question and migrate to there, cheers for the heads up :) – Sam Swift 웃 Jan 8 '16 at 10:56
2

You should not attempt to create your own crypto algorithm for production use. Creating crypto systems is work for highly specialised teams of cryptographers, but everybody needs to start somewhere off course. ^_^

Instead, use a well known cryptographic algorithm. If at all possible (and it is possible), use a class that encapsulates all the configuration options for you and provides dummy proof methods.

Take a look at:

Normally, I would say: whatever you do, don't go editing the source code provided: a tiny seemingly insignificant edit can jeopardize the whole library, and you won't even know it.

BUT: since you indicate that you want to learn from it, studying and toying around those two solutions may give you a nice start.

Not the answer you're looking for? Browse other questions tagged or ask your own question.