Rijndael is a family of nine cryptographic algorithms, offering all combinations of block sizes and key sizes in the 128/192/256-bits set. The three algorithms with 128-bit blocks (and keys of 128, 192 and 256 bits) are collectively known as the AES. The six other combinations have been defined by the Rijndael authors, but were much less investigated by cryptographers since they were not part of the target of the AES competition.
MCRYPT_RIJNDAEL_* constants stand for is poorly documented, hence unclear. This man page about a library called "mcrypt" states that:
RIJNDAEL: Rijndael is a block cipher, designed by Joan Daemen and Vincent Rijmen, and was approved for the USA's NIST Advanced Encryption Standard, FIPS-197. The cipher has a variable block length and key length. Rijndael can be implemented very efficiently on a wide range of processors and in hardware. The design of Rijndael was strongly influenced by the design of the block cipher Square. There exist three versions of this algorithm, namely: RIJNDAEL-128 (the AES winner) , RIJNDAEL-192 , RIJNDAEL-256 The numerals 128, 192 and 256 stand for the length of the block size.
The last sentence would seem to imply that the "128" would be the block size, not the key length. However, this would be true only insofar as PHP's mcrypt module faithfully translates the naming conventions of the underlying mcrypt library, which is not a given.
In any case, the documentation for
mcrypt_encrypt() states that:
The key with which the data will be encrypted. If it's smaller than the required keysize, it is padded with '\0'. It is better not to use ASCII strings for keys.
So, if you provide only 8 "strong characters", then these characters get somehow converted to bytes (Rijndael does not work on characters, it works on bytes) in some unspecified way, and if this does not yield sufficiently many bytes, then extra bytes of value 0 are added. What happens if there are too many bytes is not specified (truncation is plausible, but this is PHP -- anything can happen).
If you really want to use these functions, then you will have to make some tests, comparing encryption results with what another, better documented library would yield (in some language where bytes are bytes, e.g. C or Java). Among things to test are:
- Block size and key length.
- Conversion of a PHP string into bytes (notably in the presence of non-ASCII characters).
- Behaviour on key length mismatch (padding, truncation,...).
Relying on such an under-documented function for security is akin to skydiving without verifying the parachute. If, at bag opening time, the parachute turns out to be your week's laundry, then you will have a few seconds to reflect, while free-falling amid an expanding cloud of unclean socks, that you really should have been more cautious.