I hope this is the appropriate audience for my question. I'm rewriting a legacy PHP web application that makes heavy use of MCrypt. It's on a shared host and handles payment data as well as personally identifiable information.

What is a suitable replacement, if any, besides OpenSSL?

  • This question probably fits better on stackoverflow, since this site is more about theoretical crypto. – Edvard Fagerholm Jun 19 '14 at 10:26
  • If by payment data, you mean credit card numbers, you'll need to comply which PCI-DSS, which is a pain. The general recommendation is to never let those touch your server, using a PSP instead that receives the CC number and replaces it by an opaque token before it's sent to your server. – CodesInChaos Jun 19 '14 at 11:48
  • For the connection itself you must use HTTPS/SSL/TLS. mcrypt is mainly for encrypting data at test, but since you need to store the key where it can be accessed by your web application, the practical security gain is rather small. – CodesInChaos Jun 19 '14 at 11:50
  • 1
    This isn't about cryptography. It's either about designing a security system involving crypto, in which case it'd fit Information Security or it's about implementing it, belonging on Stack Overflow. – CodesInChaos Jun 19 '14 at 11:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.