Encryption

Implementation details

The AES-256 (CBC) encryption we apply here works as follows:

• Calculate the SHA-256 hash of the key (resulting in a 256-bit key)
• Calculate the SHA-256 hash of the Initialisation Vector and use the first 16 bytes (128 bits) as IV for AES-CBC
• Encrypt the given text with this key and Initialisation Vector with 256 bits AES in CBC (Cipher Block Chaining) mode using the Web Crypto API, after which the result is encoded with Base64 encoding
• For decryption, the given text is decoded from Base64 encoding and decrypted with the above-mentioned key and Initialisation Vector with 256-bit AES in Cipher Block Chaining mode (CBC)

AES-256 requires a key of exactly 32 bytes (256 bits) and an IV of exactly 16 bytes (128 bits). Since the supplied key and IV can be of any length, they are first hashed with SHA-256 to guarantee the correct size.

The encryption is performed entirely in the browser using the Web Crypto API. No data is sent to a server.

Note: spaces and the like at the beginning and end of the entry are not removed and are therefore important for successful decryption!

What is AES?

In cryptography, Advanced Encryption Standard (AES) is a computer encryption technology. It is the successor to the "Data Encryption Standard" (DES). AES is a subset of the Rijndael algorithm where the block size is 128-bit, and the key 128, 192 or 256 bits. Rijndael itself can all block sizes and keys that are a 32-bit multiplication with a minimum of 128-bit and a maximum of 256-bit.

Source: Wikipedia

<?php

	$key = 'my secret key';			// encryption key
	$iv  = 'my initialisation vector';	// initialisation vector

	$text = 'This is a text';		// plain text to encrypt

	// derive 256-bit key from SHA-256 hash
	$keyHash = hash('sha256', $key, true);

	// derive 128-bit IV from SHA-256 hash (first 16 bytes)
	$ivHash = substr(hash('sha256', $iv, true), 0, 16);

	// encrypt text
	$result = openssl_encrypt($text, 'aes-256-cbc', $keyHash, OPENSSL_RAW_DATA, $ivHash);

	// result contains binary string, convert to
	// ASCII using base64 encoding
	$result = base64_encode($result);

	// $result now contains string:
	// e.g. 'dGVzdA=='  (actual value depends on input)