Support for Drupal 7 is ending on 5 January 2025—it’s time to migrate to Drupal 10! Learn about the many benefits of Drupal 10 and find migration tools in our resource center.Currently there is no way to tell when decryption has failed due to an incorrect encryption key. The decrypt method returns random binary data in such cases. I believe it's critical that developers using this module be able to detect and react properly when the decryption fails.
The attached patch adds an HMAC option to the Mcrypt encryption method. When a failure is detected based on the HMAC, the decrypt method returns FALSE. Please consider for inclusion.
| Comment | File | Size | Author |
|---|---|---|---|
| #2 | enable-hmac-2576541-1.patch | 5.52 KB | glekli |
Comments
Comment #2
glekli CreditAttribution: glekli commentedComment #3
gregglesThanks for the idea and the patch.
Is this different from what https://www.drupal.org/project/real_aes provides?
Comment #4
rlhawkThe Real AES module uses OpenSSL, instead of the antiquated Mcrypt, and it's what I'd recommend as the best, and most secure, encryption option. It uses the Defuse library (https://github.com/defuse/php-encryption), which is fantastic.
I'm working on improving the Mcrypt plugin for Encrypt and adding HMAC to the improvements is probably a good idea, but I'd steer people to Real AES anyway.
Comment #5
glekli CreditAttribution: glekli commentedIt seems like that module could provide similar functionality. Nevertheless, I was going to say the same as rlhawk: this module would benefit from it as well.
Comment #6
gregglesI think there is a general goal of merging the Real AES code into this module and deprecating or downplaying the encryption method in this module, no?
Comment #7
rlhawkYes, that's what I'd prefer to do for Encrypt 3.x. We should not be writing our own encryption methods, but should instead use a solid, well-written, modern library like Defuse. See this post for more info.
In the meantime, we should certainly improve the Mcrypt encryption method, since it's included with Encrypt 2.x.
Comment #8
rlhawkHMAC authentication is a feature of the new Mcrypt AES (CBC Mode) encryption method, introduced in Encrypt 7.x-2.2. I'm marking this issue as fixed.