PHP encrypt and decrypt with certificate

Question

I am trying to think of the best way to encrypt and decrypt a message between two servers. I have found a lot of examples where people simply use a secret and PHP's mcrypt...

https://stackoverflow.com/questions/16600708/php-string-encrypt-and-decrypt

But I am thinking of using certificates instead.

https://stackoverflow.com/questions/7480681/crypt-decrypt-string-php

Am I wrong in my assumtion that it would be more safe? Or is it pretty much the same deal? With certificates you need to get to the private key on the receiving end... with the string version you need some access to the code on one of the two ends to get a hold of it.

And whould the crypto be more safe using certificates? Like creating a 2048-bit RSA.

Thanks.

Answer 1

Generally speaking, asymmetrical encryption is safer than symmetrical because remote end can only decrypt data, with no possibility to encrypt. The key is only useful for decrypt, server encrypt with a different unpublished key.

Even with self signed certificates, in my opinion security is enhanced comparing to symmetrical encryptions solutions. Go for it.

Answer 2

If you're trying to protect data-in-transit between two servers, please just use SSL/TLS certificates instead of rolling a new encryption scheme. Note that SSL/TLS technically uses symmetric encryption as well, but the shared session keys are encrypted with asymmetric keys during the initial exchange (hence the need for certificates).

One of the huge benefits of SSL/TLS is that it guarantees authentication and data integrity too, not just encryption; depending on choice of ciphersuite, it can also guarantee forward secrecy (such that an attacker who gets the private keys in the future can't decrypt past messages). For instance, if you use mcrypt in AES-CBC mode without message authentication, you're open to malleability attacks similar to http://www.jakoblell.com/blog/2013/12/22/practical-malleability-attack-against-cbc-encrypted-luks-partitions/. And if you didn't initially establish the shared secret over an SSL/TLS-protected channel anyway or use other means of authentication, you're vulnerable to a MITM attack.

SSL/TLS is the most-used form of encryption for server-server or client-server communication, and as such, its security promises (and pitfalls) are well-documented. I'm not familiar with PHP, but ith seems like this does everything you would need: http://www.php.net/manual/en/book.openssl.php.