PHP如何实现数据加密_数据加密与解密完整指南

openssl

password_hash

openssl

<?php

class DataEncryptor
{
    private string $cipherAlgo;
    private string $key;

    public function __construct(string $key, string $cipherAlgo = 'aes-256-gcm')
    {
        if (empty($key)) {
            throw new InvalidArgumentException("Encryption key cannot be empty.");
        }
        if (!in_array($cipherAlgo, openssl_get_cipher_methods())) {
            throw new InvalidArgumentException("Cipher algorithm '{$cipherAlgo}' is not supported.");
        }

        $this->key = $key;
        $this->cipherAlgo = $cipherAlgo;
    }

    /**
     * 加密数据
     * @param string $data 待加密的原始数据
     * @return string 加密后的数据（base64编码），包含IV和Tag
     * @throws Exception 如果加密失败
     */
    public function encrypt(string $data): string
    {
        $ivLen = openssl_cipher_iv_length($this->cipherAlgo);
        if ($ivLen === false) {
            throw new Exception("Failed to get IV length for {$this->cipherAlgo}.");
        }
        $iv = openssl_random_pseudo_bytes($ivLen);
        if ($iv === false) {
            throw new Exception("Failed to generate IV.");
        }

        $tag = ''; // GCM模式需要一个tag
        $encryptedData = openssl_encrypt($data, $this->cipherAlgo, $this->key, OPENSSL_RAW_DATA, $iv, $tag);

        if ($encryptedData === false) {
            throw new Exception("Encryption failed: " . openssl_error_string());
        }

        // 将IV、加密数据和Tag拼接并进行base64编码，方便存储和传输
        // IV在前，加密数据在中间，Tag在后
        return base64_encode($iv . $encryptedData . $tag);
    }

    /**
     * 解密数据
     * @param string $encryptedDataBase64 经过base64编码的加密数据
     * @return string 解密后的原始数据
     * @throws Exception 如果解密失败或数据被篡改
     */
    public function decrypt(string $encryptedDataBase64): string
    {
        $decodedData = base64_decode($encryptedDataBase64, true);
        if ($decodedData === false) {
            throw new Exception("Base64 decoding failed.");
        }

        $ivLen = openssl_cipher_iv_length($this->cipherAlgo);
        if ($ivLen === false) {
            throw new Exception("Failed to get IV length for {$this->cipherAlgo}.");
        }

        // 从解码后的数据中分离IV、加密数据和Tag
        $iv = substr($decodedData, 0, $ivLen);
        $tag = substr($decodedData, -16); // GCM模式的Tag通常是16字节
        $encryptedData = substr($decodedData, $ivLen, -16);

        if (strlen($iv) !== $ivLen) {
             throw new Exception("Invalid IV length.");
        }
        if (strlen($tag) !== 16) { // 假设GCM Tag是16字节
             throw new Exception("Invalid Tag length.");
        }

        $decryptedData = openssl_decrypt($encryptedData, $this->cipherAlgo, $this->key, OPENSSL_RAW_DATA, $iv, $tag);

        if ($decryptedData === false) {
            throw new Exception("Decryption failed or data was tampered: " . openssl_error_string());
        }

        return $decryptedData;
    }

    /**
     * 生成一个安全的随机密钥
     * @param int $length 密钥长度（字节），对于AES-256，通常是32字节
     * @return string
     * @throws Exception
     */
    public static function generateKey(int $length = 32): string
    {
        $key = openssl_random_pseudo_bytes($length);
        if ($key === false) {
            throw new Exception("Failed to generate random key.");
        }
        return $key;
    }
}

// 示例使用
try {
    // 1. 生成一个安全的密钥 (在实际应用中，密钥应该从安全的地方加载，而不是每次运行时生成)
    $encryptionKey = DataEncryptor::generateKey(32); // AES-256 需要32字节密钥
    // 假设我们把这个密钥存储在一个环境变量中或者安全配置文件里
    // $encryptionKey = getenv('APP_ENCRYPTION_KEY');

    $encryptor = new DataEncryptor($encryptionKey);

    $originalData = "这是一段需要加密的敏感信息，比如用户的个人资料或支付数据。";
    echo "原始数据: " . $originalData . PHP_EOL;

    // 2. 加密数据
    $encryptedResult = $encryptor->encrypt($originalData);
    echo "加密后的数据 (Base64编码): " . $encryptedResult . PHP_EOL;

    // 3. 解密数据
    $decryptedResult = $encryptor->decrypt($encryptedResult);
    echo "解密后的数据: " . $decryptedResult . PHP_EOL;

    // 验证是否一致
    if ($originalData === $decryptedResult) {
        echo "加密解密成功，数据一致。" . PHP_EOL;
    } else {
        echo "加密解密失败，数据不一致！" . PHP_EOL;
    }

    // 尝试篡改数据（模拟攻击）
    echo PHP_EOL . "--- 模拟数据篡改 ---" . PHP_EOL;
    $tamperedEncryptedResult = substr($encryptedResult, 0, -5) . 'AAAAA'; // 篡改最后几个字符
    try {
        $encryptor->decrypt($tamperedEncryptedResult);
    } catch (Exception $e) {
        echo "解密篡改数据失败，符合预期: " . $e->getMessage() . PHP_EOL;
    }

} catch (Exception $e) {
    echo "错误: " . $e->getMessage() . PHP_EOL;
}

// 对于密码存储，请使用 password_hash 和 password_verify
echo PHP_EOL . "--- 密码哈希示例 ---" . PHP_EOL;
$userPassword = "MySecurePassword123";
$hashedPassword = password_hash($userPassword, PASSWORD_BCRYPT); // 使用bcrypt算法
echo "用户密码: " . $userPassword . PHP_EOL;
echo "哈希后的密码: " . $hashedPassword . PHP_EOL;

if (password_verify($userPassword, $hashedPassword)) {
    echo "密码验证成功。" . PHP_EOL;
} else {
    echo "密码验证失败。" . PHP_EOL;
}

// 尝试错误密码
if (password_verify("WrongPassword", $hashedPassword)) {
    echo "错误密码验证成功 (不应该发生)！" . PHP_EOL;
} else {
    echo "错误密码验证失败，符合预期。" . PHP_EOL;
}

?>

openssl

openssl

md5()

sha1()

hash()

password_hash()

password_verify()

bcrypt

Argon2

password_hash

openssl_encrypt

openssl_decrypt

openssl_public_encrypt

openssl_private_decrypt