PHP函数怎样使用加密函数保护数据 PHP函数数据加密函数的实用技巧

openssl_encrypt

openssl_decrypt

<?php
// 确保你的密钥是随机生成的，并且安全存储，不要硬编码！
// 比如从环境变量中读取，或者通过专门的密钥管理服务获取。
// 这里的 'your_super_secret_key_32_bytes_long' 仅为示例，实际中应生成。
$key = hex2bin('e528b3f1c6d9a0f4e7b2a9d8c1f0e3d2a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0'); // 32字节的十六进制密钥

function encryptData(string $data, string $key): string
{
    $cipher = 'aes-256-gcm';
    if (!in_array($cipher, openssl_get_cipher_methods(true))) {
        throw new Exception('Cipher method not supported.');
    }

    // GCM模式下，IV长度通常是12字节
    $ivlen = openssl_cipher_iv_length($cipher);
    $iv = openssl_random_pseudo_bytes($ivlen);
    if ($iv === false) {
        throw new Exception('Failed to generate IV.');
    }

    $tag = null; // GCM模式的认证标签会通过引用传递回来

    $encrypted = openssl_encrypt($data, $cipher, $key, OPENSSL_RAW_DATA, $iv, $tag);
    if ($encrypted === false) {
        throw new Exception('Encryption failed.');
    }

    // 将IV、加密数据和认证标签拼接起来，通常用base64编码方便存储和传输
    // IV是公开的，但必须是唯一的
    return base64_encode($iv . $tag . $encrypted);
}

function decryptData(string $encryptedData, string $key): string
{
    $cipher = 'aes-256-gcm';
    if (!in_array($cipher, openssl_get_cipher_methods(true))) {
        throw new Exception('Cipher method not supported.');
    }

    $decoded = base64_decode($encryptedData);
    if ($decoded === false) {
        throw new Exception('Base64 decode failed.');
    }

    $ivlen = openssl_cipher_iv_length($cipher);
    $taglen = 16; // GCM模式的认证标签通常是16字节

    // 从拼接的数据中分离出IV、Tag和密文
    $iv = substr($decoded, 0, $ivlen);
    $tag = substr($decoded, $ivlen, $taglen);
    $ciphertext = substr($decoded, $ivlen + $taglen);

    if (strlen($iv) !== $ivlen || strlen($tag) !== $taglen) {
        throw new Exception('Invalid IV or Tag length.');
    }

    $decrypted = openssl_decrypt($ciphertext, $cipher, $key, OPENSSL_RAW_DATA, $iv, $tag);
    if ($decrypted === false) {
        // 解密失败通常意味着密钥不匹配，或者数据在传输过程中被篡改了（认证失败）
        throw new Exception('Decryption failed, possibly due to wrong key or data tampering.');
    }

    return $decrypted;
}

// 示例使用
try {
    $originalData = "这是一段需要加密的敏感信息，比如用户的个人资料。";
    echo "原始数据: " . $originalData . "\n";

    $encryptedResult = encryptData($originalData, $key);
    echo "加密后的数据: " . $encryptedResult . "\n";

    $decryptedResult = decryptData($encryptedResult, $key);
    echo "解密后的数据: " . $decryptedResult . "\n";

    if ($originalData === $decryptedResult) {
        echo "加密解密成功，数据一致。\n";
    } else {
        echo "加密解密失败或数据不一致。\n";
    }

    // 尝试用错误的密钥解密
    $wrongKey = hex2bin('f528b3f1c6d9a0f4e7b2a9d8c1f0e3d2a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0');
    try {
        decryptData($encryptedResult, $wrongKey);
    } catch (Exception $e) {
        echo "尝试用错误密钥解密： " . $e->getMessage() . "\n"; // 预期会报错
    }

} catch (Exception $e) {
    echo "发生错误: " . $e->getMessage() . "\n";
}
?>

$key

openssl_random_pseudo_bytes()

encryptData

openssl_encrypt

$tag

openssl_decrypt

false

<?php
// 示例：如果非要用CBC模式，如何结合HMAC保证完整性
// 注意：HMAC密钥应与加密密钥不同且独立生成
$encryptionKey = hex2bin('e528b3f1c6d9a0f4e7b2a9d8c1f0e3d2a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0'); // 32字节
$hmacKey = hex2bin('a0f4e7b2a9d8c1f0e3d2a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e528b3f1c6d9'); // 32字节，不同的密钥！

function encryptDataWithHmac(string $data, string $encryptionKey, string $hmacKey): string
{
    $cipher = 'aes-256-cbc';
    $ivlen = openssl_cipher_iv_length($cipher);
    $iv = openssl_random_pseudo_bytes($ivlen);

    $encrypted = openssl_encrypt($data, $cipher, $encryptionKey, OPENSSL_RAW_DATA, $iv);
    if ($encrypted === false) {
        throw new Exception('Encryption failed.');
    }

    // 对IV和密文生成HMAC
    $hmac = hash_hmac('sha256', $iv . $encrypted, $hmacKey, true);

    return base64_encode($iv . $encrypted . $hmac);
}

function decryptDataWithHmac(string $encryptedData, string $encryptionKey, string $hmacKey): string
{
    $decoded = base64_decode($encryptedData);
    if ($decoded === false) {
        throw new Exception('Base64 decode failed.');
    }

    $cipher = 'aes-256-cbc';
    $ivlen = openssl_cipher_iv_length($cipher);
    $hmaclen = 32; // SHA256生成32字节的HMAC

    $iv = substr($decoded, 0, $ivlen);
    $ciphertext = substr($decoded, $ivlen, -($hmaclen));
    $receivedHmac = substr($decoded, -($hmaclen));

    if (strlen($iv) !== $ivlen || strlen($receivedHmac) !== $hmaclen) {
        throw new Exception('Invalid IV or HMAC length.');
    }

    // 重新计算HMAC并进行时间恒定比较
    $calculatedHmac = hash_hmac('sha256', $iv . $ciphertext, $hmacKey, true);
    if (!hash_equals($receivedHmac, $calculatedHmac)) {
        // 完整性验证失败，数据可能被篡改
        throw new Exception('Data integrity check failed. Possible tampering.');
    }

    // HMAC验证通过，再进行解密
    $decrypted = openssl_decrypt($ciphertext, $cipher, $encryptionKey, OPENSSL_RAW_DATA, $iv);
    if ($decrypted === false) {
        throw new Exception('Decryption failed.');
    }

    return $decrypted;
}

// 示例使用
try {
    $originalData = "这段数据用CBC加密，并用HMAC保护完整性。";
    echo "原始数据: " . $originalData . "\n";

    $encryptedResult = encryptDataWithHmac($originalData, $encryptionKey, $hmacKey);
    echo "CBC加密后的数据: " . $encryptedResult . "\n";

    $decryptedResult = decryptDataWithHmac($encryptedResult, $encryptionKey, $hmacKey);
    echo "CBC解密后的数据: " . $decryptedResult . "\n";

    if ($originalData === $decryptedResult) {
        echo "CBC加密解密成功，数据一致。\n";
    } else {
        echo "CBC加密解密失败或数据不一致。\n";
    }

    // 尝试篡改数据
    $tamperedData = $encryptedResult;
    $tamperedData[10] = chr(ord($tamperedData[10]) ^ 1); // 翻转一个位
    try {
        decryptDataWithHmac($tamperedData, $encryptionKey, $hmacKey);
    } catch (Exception $e) {
        echo "尝试篡改数据： " . $e->getMessage() . "\n"; // 预期会报错
    }

} catch (Exception $e) {
    echo "发生错误: " . $e->getMessage() . "\n";
}
?>