PHP 中字符串的安全密码加密/解密
我想知道是否存在一种简单但安全的方法来加密字符串（而不是密码），并且密码不存储在服务器上，在 PHP 中。
我已经检查过 PHP 的可逆密码加密例程，但我不确定它是否足够安全入侵者是否可以访问服务器和源。
我们谈论的是一个自动系统，其中计算机向服务器发送请求，服务器将信息存储在日志中。所以我想我可以在请求标头中发送加密密码，最好是加密的，但是如果不以某种方式将密码存储在服务器上，就很难解密。等等，我想我可能让事情变得有点复杂了，但我希望你明白......这是为了保证信息的安全，即使黑客完全控制服务器。
I wanted to know if there exists a somewhat simple, but secure, method to encrypt strings(not passwords), with a password which is not stored on the server, in PHP.
I've checked A reversible password encryption routine for PHP, but I'm unsure if it is secure enough if intruders have access to the server and source.
We're talking about a automatic system where a computer sends a request to a server, which stores information in a log. So I'm thinking I could send the encryption password in the request header, preferably encrypted, but then it would be difficult to decrypt without storing the password somehow on the server. Wait, I think i might be complicating things a bit too much, but I hope you get the idea... It's meant to keep the information safe, even if hackers have full control over the server.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
如果我理解正确的话，您的目标是由服务器加密的日志。请求以明文形式发送，但您希望记录每个用户访问统计信息等内容，并且您认为此数据是机密的，因此它应该由服务器加密，并且也应该由服务器解密，如果必要的。
如果真是这样的话，其实事情并不算太复杂。
然后你会意识到你造成了一个先有蛋还是先有鸡的问题——该文件再次需要服务器的密码才能访问存储在其中的密钥。但这是技巧 - 您必须在服务器启动时手动输入密钥，这就是您需要的临时组件。文件的密码应该是带外信息（例如放置在物理保管库中）并且不存在于计算机本身上。
另一种替代方案（但可能不太安全，因为密码将以某种物理形式存在）是依赖特定于操作系统的“密码库”，例如 Windows 的 隔离存储。
If I understand you correctly, you aim for a log that is encrypted by the server. The requests are sent in plain, but you'd like to log something like per-user access statistics or the like and you deem this data to be confidential, so it should be encrypted by the server and also be decrypted by the server, if necessary.
If this is the case, it is actually not all too complicated.
Then you will realize that you created a hen-egg problem - the file again needs a password for the server to have access to the key stored inside. But here's the trick - you will have to enter the key upon server startup manually, and that's the ephemeral component you need. The password for the file should be out-of-band information (e.g. placed in a physical vault) and nowhere on the computer itself.
An alternative (but potentially less secure because the password would be present in some physical form) is to rely on OS-specific "password vaults" such as Windows' Isolated Storage.
一种似乎满足您要求的选择是使用公钥/私钥加密。如果您让用户使用公钥加密字符串，然后将加密数据存储在服务器上，则攻击者将无法解密该数据。
当/如果您需要解密数据时，只需将其复制到您拥有私钥的位置并使用它进行解密。
One option for this, which would seem to meet your requirements, would be to use public/private key cryptography. If you had the user encrypt the string using a public key then had the encrypted data stored on the server it would not be possible for an attacker to decrypt the data.
when/if you need to decrypt the data just copy it to a location where you have the private key and use that for decryption.
我会使用 Mcrypt 来加密/解密 php 中的数据。
我选择的算法是twofish。
您将需要一个密钥来加密/解密数据，并且通过请求发送数据可能会出现安全问题，除非您实施了 ssl。
如果加密应该根据请求而不是实时进行，那么您可以只在控制台中执行脚本，这样密码就不会存储在服务器上。
加密/解密的代码很简单：
I would go with Mcrypt to encrypt/decrypt data in php.
My algorithm of choice would be twofish.
You will need a key to encrypt/decrypt data and sending it via request could be a security issue unless you have ssl implemented.
If the encryption should be on request not real-time thing than you could just execute the script in console so the password is not stored on the server.
The code for encryption/decryption is simple: