I have pushed some code to GitHub to demonstrate the usage of symmetric key encryption in PHP. It is a small key-value storage library and it (optionally) offers ability to encrypt the stored information. I would like to hear your comments about a couple of design decisions I made:
Encryption is done using AES in CBC mode (random IV), with "encrypt-then-MAC" authentication. The information is basically a PHP array, which is serialized and optionally compressed (gzdeflate). This string is then encrypted. I would like to hear some opinions would it be worth it to add an another ("inner") MAC verification, which would take care of checking that the data is valid after uncompression? At first, this sounds like a waste of time, since there is already one MAC check. But on the other hand, this could counter some issues that might arise because of errors in the uncompression layer etc. Any comments about this?
Another thing, crypto experts recommends that when using CTR mode, the nonce should be generated using a unique and increasing "message number". However, in TCrypto there is no way to keep a list of such message numbers, so I have made the decision not to use CTR mode. Do you think it would be safe to use CTR mode by generating the "nonce" randomly (/dev/urandom)? Encryption keys in TCrypto are derived using a constant key, timestamps and the IV (this ensures the encryption keys are unique for each encryption operation).
Any other comments?
Thanks a lot!