data encryption in PHP using base64 with key

Question

I am using base64 for encryption and decryption.

But for some values, encrypted data is not decrypting properly and add special characters. Using current key, word 'skype' is not encrypting and decrypting correctly instead special characters appear on decrypting.

Can anyone please tell me, what the problem is? (code is simple available on Google but I have checked blogs and forum, can't find any such thing related to this issue, which means problem is in my code)

encrypt.php

<?php
$id= $_GET['id'];
$encrypted = encrypt($id, "check");
echo $encrypted ;
function encrypt($string, $key) 
{
 $result = '';
 for($i=0; $i<strlen($string); $i++) {
 $char = substr($string, $i, 1);
 $keychar = substr($key, ($i % strlen($key))-1, 1);
 $char = chr(ord($char)+ord($keychar));
 $result.=$char;
 }
 return base64_encode($result);
}
?>

decrypt.php

<?php
$id= $_GET['id'];
$decrypted = decrypt($id, "check");
echo $decrypted ;
function decrypt($string, $key) 
{
 $result = '';
 $string = base64_decode($string);
 for($i=0; $i<strlen($string); $i++) {
 $char = substr($string, $i, 1);
 $keychar = substr($key, ($i % strlen($key))-1, 1);
 $char = chr(ord($char)-ord($keychar));
 $result.=$char;
 }
 return $result;
}
?>

• Mark Baker: No you're not using base64 for encryption; you're using base64 for encoding.... you're using a weird for($i=0; $i<strlen($string); $i++) { $char = substr($string, $i, 1); $keychar = substr($key, ($i % strlen($key))-1, 1); $char = chr(ord($char)+ord($keychar)); $result.=$char; } for "encrypting"
• K.Liaqat: I am new in PHP.. can you please elaborate this?? @MarkBaker if I am not wrong you mean that I should use mk5.
• Mark Baker: mk5?!? Do you mean md5? No, md5 is a hashing algorithm. It's one-way (you can't get the cow back from the beefburger), and flawed
• Mark Baker: Well you could always use PHP's built-in encryption functions rathe rthan a bad homebrew.... but this works correctly as long as your input id to decrypt is correct
• K.Liaqat: @MarkBaker, now I am shifted to md5 (thanks for your suggestion). Here is my code $key="check"; $encrypted = base64_encode(mcrypt_encrypt(MCRYPT_RIJNDAEL_256, md5($key), $variableValue, MCRYPT_MODE_CBC, md5(md5($key)))); decryption code is as follow $key="check"; $variableValue ="skype" $decrypted = rtrim(mcrypt_decrypt(MCRYPT_RIJNDAEL_256, md5($key), base64_decode($variableValue), MCRYPT_MODE_CBC, md5(md5($key))), "0円"); echo $decrypted ; Now input skype (encryption value =%05¢%20_¤) output after decryption (X¡xEîl0^~=‹&@y—ß^¥„Òê£}΋;JåHà $%$%$)

Answer 1

Basically...

• Base64 isn't encryption, it's encoding. (Linked article explains the difference between various bits of cryptography and programming vocabulary.)
• If you're not a crypto expert, you shouldn't really be deploying home-grown cryptography code.
• Use a PHP cryptography library instead of trying to write your own (until you become an expert).
• If you need to know the lower-level internals beyond "use a library": read updated cryptographic right answers (and the original: cryptographic right answers).