enikola.de

Today I’ve looked around the php.net site for some basic encryption and decryption functions but unfortunately all there is only base64. So I’ve put together a smallish one myself. You can use it to exchange securely data between two entities, but keep in mind that this is a synchronous cryptography, ie. all communication partners must share a common secret.

function encrypt( $plain ) {
  $salt = 'xn237 8789123AZSBJK#$$#^ fdopi][{}463bv5%#&! si8d 5642 v4189sda44181!#$%!S08F09DQXMlkjhYHUsad';
  $cypher = '';

  // expand the salt to meet the length of the plain text
  if ( strlen($plain) > strlen($salt) ) {
    $loop = true;
    while ( $loop ) {
      $salt .= $salt;
      if ( strlen($salt) >= strlen($plain) ) { $loop = false; }
      }
  }

  // encrypt
  for ( $i = 0; $i < strlen($plain); $i++ ) {
    $char1 = $plain{$i};
    $char2 = $salt{$i};
    $ascii1 = ord( $char1 );
    $ascii2 = ord( $char2 );
    $cypher .= chr( $ascii1 + $ascii2 );
  }
  return $cypher;
}

function decrypt( $cypher ) {
  $salt = 'xn237 8789123AZSBJK#$$#^ fdopi][{}463bv5%#&! si8d 5642 v4189sda44181!#$%!S08F09DQXMlkjhYHUsad';
  $plain = '';

  // expand the salt to meet the length of the cypher text
  if ( strlen($cypher) > strlen($salt) ) {
    $loop = true;
    while ( $loop ) {
      $salt .= $salt;
      if ( strlen($salt) >= strlen($cypher) ) { $loop = false; }
      }
  }

  // decrypt
  for ( $i = 0; $i < strlen($cypher); $i++ ) {
    $char1 = $cypher{$i};
    $char2 = $salt{$i};
    $ascii1 = ord($char1);
    $ascii2 = ord($char2);
    $plain .= chr( $ascii1 + $ascii2 );
  }
  return $plain;
}

Hmm ... both functions seem to be quite ... the same. Yes, they are the same.

function decenc( $in ) {
  $salt = 'xn237 8789123AZSBJK#$$#^ fdopi][{}463bv5%#&! si8d 5642 v4189sda44181!#$%!S08F09DQXMlkjhYHUsad';
  $out = '';

  // expand the salt to meet the length of the  $in
  $inlen = strlen($in);
  if ( $inlen > strlen($salt) ) {
    while ( $inlen > strlen($salt) ) {
      $salt .= $salt;
    }
  }

  // perform operation
  for ( $i = 0; $i < $inlen; $i++ ) {
    $char1 = $in{$i};
    $char2 = $salt{$i};
    $ascii1 = ord( $char1 );
    $ascii2  = ord( $char2 );
    $out .= chr( $ascii1 + $ascii2 );
  }
  return $out;
}

The most important part of this algorithm is the salt. It must be as random as possible. But it must be known to all communication partners. Which, of course, means that at some point, before exchanging data, the salt must be passed over on a secure line.

String chunking and parts shuffling won’t strengthen the method, because the method is static: strlen(input) == strlen(output) and if input1 == input2 then output1 == output2.

This approach of encrypting data is quite simple and insecure, so it should be avoided. However there might be few scenarios, where a much simpler solution is preferred over AES, Diffie-Hellman or any PKI.

And one last thing: I’m not using it, I’ve been just thinking simplistic and minimalistic today.