Encrypt is a Drupal module that provides an application programming interface (API) for performing two-way data encryption. It allows modules to encrypt data such that it can be decrypted using the same key that was used to encrypt the data. This is useful for storing sensitive information.
There is no native way to do two-way encryption in Drupal. There is also not a very standard way of performing encryption in PHP without extensions. This module aims to make it easy for other modules to keep data secured in an extensible way that does not inherently require any other dependencies.
This module is an API that other modules can use to encrypt data. It doesn't provide any user-facing features of its own, aside from administration pages to manage configuration.
At its core, Encrypt provides two functions, encrypt() and decrypt():
// Encrypt data.
$encrypted_text = encrypt('some string to encrypt');
// Decrypt data.
Encrypt allows multiple configurations to be managed within a Drupal site. Each configuration contains an encryption method and a key provider, along with any additional settings that the method or provider requires.
The module is bundled with three encryption methods:
- Mcrypt AES (CBC Mode): Uses Mcrypt and AES in CBC mode, with HMAC authentication; the key must be 16, 24, or 32 bytes.
- PHP Secure Communications Library: This method uses the phpseclib PHP extension and is only recommended if Mcrypt is not available.
- None: This uses no encryption and is only useful for testing.
Deprecated Encryption Methods
The following encryption methods were deprecated starting with version 7.x-2.2. Data encrypted with these methods can still be decrypted, but they are not available to use when encrypting new data.
- Basic: A simple mathematical method that does not require any PHP extensions.
- Mcrypt AES 256: A method that uses Mcrypt and Rijndael for the cipher.
Other modules can provide additional encryption methods via CTools plugin definitions.
The module is bundled with two key providers:
- Variable: Uses a configuration variable, preferably defined in the site's settings.php file.
- File: Uses a file, preferably located outside of the web root directory.
Deprecated Key Provider
The following key provider was deprecated starting with version 7.x-2.2. Data encrypted with this provider can still be decrypted, but it is not available to use when encrypting new data.
- Drupal Private Key: Uses Drupal's private key from the database.
Other modules can provide additional key providers via CTools plugin definitions.
Storing the Encrypted Data
It is up to the module calling encrypt() to manage and store the encrypted data. The chosen method of encryption and key provider are returned with the encrypted results, meaning that, even if method or key settings are changed for the site, previously encrypted data can still be decrypted.
Download and enable the Encrypt module in the usual fashion. On installation, a default configuration is created using Basic as the encryption method and Drupal Private Key as the key provider.
Upgrading From a Prior Version
If the module is upgraded from a prior version (before configurations were added), the previously selected settings will be used to create the default configuration. The process should be seamless, but it is highly recommended to do a full backup before upgrading. If you want to be extra cautious, decrypt all data, upgrade, then re-encrypt. Be sure to run update.php immediately after upgrading.
Creating Additional Encryption Methods or Key Providers
In version 7.x-2.x, encryption methods and key providers are CTools plugin types. Creating your own method or provider that can be used by the Encrypt API is as simple as defining a new CTools plugin. Instructions are included in the help files included with the module.
Modules That Use the Encrypt API
|Encrypt Password||7.x-1.0-beta2||7.x-2.x||Encrypts the hashes of user passwords.|
|Field Encryption||7.x-1.0-beta2||7.x-1.1, 7.x-2.x||Encrypts entity fields.|
|Webform Encrypt||7.x-1.0||7.x-1.1, 7.x-2.x (with patch)||Encrypts data submitted via webform.|
|Townsend Security Key Connection||7.x-1.1||7.x-1.1, 7.x-2.x||Adds a key provider for offsite key storage; adds an encryption method for offsite data encryption.|
|Real AES||7.x-1.0||7.x-2.x||Adds an encryption method that uses the Defuse PHP-encryption library to provide highly secure authenticated encryption.|
|Encrypt Form API||7.x-2.x||7.x-1.1, 7.x-2.x||Adds a Form API attribute (#encrypt).|
|Encrypted Files||7.x-2.x-dev||7.x-2.x||Provides the ability to encrypt uploaded files.|
Obfuscation versus Security
By default, this module uses a key that is stored in your database while the main use of this module is to store encrypted data in the database. This is actually just an example of obfuscation because if the database itself is compromised all the necessary parts are available to retrieve that data (even if it requires more effort to do that).
When you put your key outside the webroot, the encrypted text and key are now in two distinct parts of the system which will have a lot less likelihood of being compromised at the same time. It is still important to know that this module does not make your data completely secure from being decrypted since a dedicated attacker could try to use brute force to decrypt the information. The module does allow a level of security that Drupal does not inherently provide and in fact there are many levels that need to be thought about to have fully secure data.
Encrypt Form API
The Encrypt Form API module, which adds an '#encrypt' property as a Form API element, was part of the Encrypt module, but as of July 5, 2014, it has been removed from the 7.x-2.x release and moved into its own project.
Roadmap and maintenance
The 7.x-2.2 release is the current recommended release for Encrypt. Submit any bugs or requests in the issue queue. The 7.x-1.x branch is no longer supported. The 6.x-1.x branch is in "maintenance mode."