I'm planning to implement Tiny Encryption Algorithm and exchange data between two PHP sites.
Specifically, using the code presented at PHP-einfach.de
Does anyone have any experiences / thoughts / comments on using this algorithm? (other than why are you using it)
Background: Its some code that i'm planning to put in a drupal module. the drupal module allows authenticated users of that site to connect to my site. I'm planning to give secret apikeys to these drupal site owners. The code on the drupal site will encrypt data: "userid-commandid-time" with the apikey and show this as a hidden field on a form. Their users submitting that form will be redirected to my site with this encrypted data.. When i get it, i'll decrypt it using my copy of the apikey and check the other data values. Time is being sent to make the request valid for a limited time only.
Also, i did consider oauth, but we're later in our development cycle and work is pretty much done. the system does not have to be 100% secure, its going to be exposed to a limited set of people (the drupal module users). it just has to be reasonable enough to dissuade most wannabe pranksters. gaining access to the key and our encryption methodology would at most allow the hacker spoofed (but limited) access to our system.