mcrypt Deprecation — Migrate to OpenSSL

TL;DR

Explanation

mcrypt was PHP's encryption extension for decades — but it was unmaintained since 2007, used outdated algorithms, and had a confusing API. PHP 7.1 deprecated it, PHP 7.2 removed it. Migration: AES-256-CBC via openssl_encrypt($data, 'aes-256-cbc', $key, 0, $iv). The correct modern option: libsodium (PHP 7.2+) with sodium_crypto_secretbox() — authenticated encryption preventing tampering. Key management: never hardcode keys, use environment variables or a secrets manager. Always use authenticated encryption (AES-GCM or libsodium) — unauthenticated AES-CBC can be attacked via padding oracle.

Common Misconception

Why It Matters

Common Mistakes

• Migrating from mcrypt to AES-CBC without adding authentication (HMAC) — still vulnerable.
• Not using sodium_crypto_secretbox() which handles key+nonce management correctly.
• Hardcoding encryption keys in source code.

Code Examples

// mcrypt — removed in PHP 7.2:
$encrypted = mcrypt_encrypt(MCRYPT_RIJNDAEL_256, $key, $data, MCRYPT_MODE_CBC);

// Modern libsodium (PHP 7.2+) — authenticated encryption:
$nonce = random_bytes(SODIUM_CRYPTO_SECRETBOX_NONCEBYTES);
$key = sodium_crypto_secretbox_keygen();
$encrypted = sodium_crypto_secretbox($data, $nonce, $key);

// Decrypt:
$decrypted = sodium_crypto_secretbox_open($encrypted, $nonce, $key);

References

• ↗ https://www.php.net/manual/en/book.sodium.php

Tags

Related Terms