I am trying to think of the best way to encrypt and decrypt a message between two servers. I have found a lot of examples where people simply use a secret and PHP's mcrypt...


But I am thinking of using certificates instead.


Am I wrong in my assumtion that it would be more safe? Or is it pretty much the same deal? With certificates you need to get to the private key on the receiving end... with the string version you need some access to the code on one of the two ends to get a hold of it.

And whould the crypto be more safe using certificates? Like creating a 2048-bit RSA.


  • Mcrypt has only symmetrical encryption. If you want to go for certificates, you need openssl extension which implements asymmetrical encryption.
    – Ghigo
    Commented Mar 6, 2014 at 11:27
  • I know what solution I need to do both. My question is what is more secure... Commented Mar 6, 2014 at 11:48
  • 1
    The good think about asymmetrical encryption is that remote end cannot encrypt but only decrypt. This is surely a safer approach.
    – Ghigo
    Commented Mar 6, 2014 at 11:57
  • Great that was my assumption as well :) Commented Mar 6, 2014 at 12:08
  • "need to get the private key on the receiving end" is maybe not the best concept. You would rather "get the public key to the sending end" Commented Apr 6, 2014 at 9:06

2 Answers 2


Generally speaking, asymmetrical encryption is safer than symmetrical because remote end can only decrypt data, with no possibility to encrypt. The key is only useful for decrypt, server encrypt with a different unpublished key.

Even with self signed certificates, in my opinion security is enhanced comparing to symmetrical encryptions solutions. Go for it.

  • the feature that the receiving end is limited to decrypting the message and prevented from encrypting, required that the "public key" is not really public, right? Commented Apr 6, 2014 at 9:01
  • How does the key signing play a role here? Commented Apr 6, 2014 at 9:08
  • "public key" has to be published to clients which want to connect to server. The point of signing a key is to certify that informations inside key are valid and trusted. You require an third party known authority for this and you have to pay. This authority will verify your identity and guarantee for you when clients connect to your server exchanging the signed key.
    – Ghigo
    Commented Apr 7, 2014 at 9:22

If you're trying to protect data-in-transit between two servers, please just use SSL/TLS certificates instead of rolling a new encryption scheme. Note that SSL/TLS technically uses symmetric encryption as well, but the shared session keys are encrypted with asymmetric keys during the initial exchange (hence the need for certificates).

One of the huge benefits of SSL/TLS is that it guarantees authentication and data integrity too, not just encryption; depending on choice of ciphersuite, it can also guarantee forward secrecy (such that an attacker who gets the private keys in the future can't decrypt past messages). For instance, if you use mcrypt in AES-CBC mode without message authentication, you're open to malleability attacks similar to http://www.jakoblell.com/blog/2013/12/22/practical-malleability-attack-against-cbc-encrypted-luks-partitions/. And if you didn't initially establish the shared secret over an SSL/TLS-protected channel anyway or use other means of authentication, you're vulnerable to a MITM attack.

SSL/TLS is the most-used form of encryption for server-server or client-server communication, and as such, its security promises (and pitfalls) are well-documented. I'm not familiar with PHP, but ith seems like this does everything you would need: http://www.php.net/manual/en/book.openssl.php.

  • +1 for being good enough to mention that in most cases (message length > keylegth of asymmetric key) symmetric encryption is used internally. Showing that the decision in this case is really not possible. It will also be symmetric ciphers involved. Commented Apr 6, 2014 at 9:04
  • I guess my question wasn't written well enough. Of course I am using SSL/TLS as well.. Commented Apr 6, 2014 at 12:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .