PHP函数怎样使用加密函数保护数据 PHP函数数据加密函数的实用技巧

<?php // 确保你的密钥是随机生成的，并且安全存储，不要硬编码！ // 比如从环境变量中读取，或者通过专门的密钥管理服务获取。 // 这里的 'your_super_secret_key_32_bytes_long' 仅为示例，实际中应生成。 $key = hex2bin('e528b3f1c6d9a0f4e7b2a9d8c1f0e3d2a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0'); // 32字节的十六进制密钥  function encryptData(string $data, string $key): string {     $cipher = 'aes-256-gcm';     if (!in_array($cipher, openssl_get_cipher_methods(true))) {         throw new Exception('Cipher method not supported.');     }      // GCM模式下，IV长度通常是12字节     $ivlen = openssl_cipher_iv_length($cipher);     $iv = openssl_random_pseudo_bytes($ivlen);     if ($iv === false) {         throw new Exception('Failed to generate IV.');     }      $tag = null; // GCM模式的认证标签会通过引用传递回来      $encrypted = openssl_encrypt($data, $cipher, $key, OPENSSL_RAW_DATA, $iv, $tag);     if ($encrypted === false) {         throw new Exception('Encryption failed.');     }      // 将IV、加密数据和认证标签拼接起来，通常用base64编码方便存储和传输     // IV是公开的，但必须是唯一的     return base64_encode($iv . $tag . $encrypted); }  function decryptData(string $encryptedData, string $key): string {     $cipher = 'aes-256-gcm';     if (!in_array($cipher, openssl_get_cipher_methods(true))) {         throw new Exception('Cipher method not supported.');     }      $decoded = base64_decode($encryptedData);     if ($decoded === false) {         throw new Exception('Base64 decode failed.');     }      $ivlen = openssl_cipher_iv_length($cipher);     $taglen = 16; // GCM模式的认证标签通常是16字节      // 从拼接的数据中分离出IV、Tag和密文     $iv = substr($decoded, 0, $ivlen);     $tag = substr($decoded, $ivlen, $taglen);     $ciphertext = substr($decoded, $ivlen + $taglen);      if (strlen($iv) !== $ivlen || strlen($tag) !== $taglen) {         throw new Exception('Invalid IV or Tag length.');     }      $decrypted = openssl_decrypt($ciphertext, $cipher, $key, OPENSSL_RAW_DATA, $iv, $tag);     if ($decrypted === false) {         // 解密失败通常意味着密钥不匹配，或者数据在传输过程中被篡改了（认证失败）         throw new Exception('Decryption failed, possibly due to wrong key or data tampering.');     }      return $decrypted; }  // 示例使用 try {     $originalData = "这是一段需要加密的敏感信息，比如用户的个人资料。";     echo "原始数据: " . $originalData . "n";      $encryptedResult = encryptData($originalData, $key);     echo "加密后的数据: " . $encryptedResult . "n";      $decryptedResult = decryptData($encryptedResult, $key);     echo "解密后的数据: " . $decryptedResult . "n";      if ($originalData === $decryptedResult) {         echo "加密解密成功，数据一致。n";     } else {         echo "加密解密失败或数据不一致。n";     }      // 尝试用错误的密钥解密     $wrongKey = hex2bin('f528b3f1c6d9a0f4e7b2a9d8c1f0e3d2a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0');     try {         decryptData($encryptedResult, $wrongKey);     } catch (Exception $e) {         echo "尝试用错误密钥解密： " . $e->getMessage() . "n"; // 预期会报错     }  } catch (Exception $e) {     echo "发生错误: " . $e->getMessage() . "n"; } ?>

$key

openssl_random_pseudo_bytes()

encryptData

$tag

<?php // 示例：如果非要用CBC模式，如何结合HMAC保证完整性 // 注意：HMAC密钥应与加密密钥不同且独立生成 $encryptionKey = hex2bin('e528b3f1c6d9a0f4e7b2a9d8c1f0e3d2a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0'); // 32字节 $hmacKey = hex2bin('a0f4e7b2a9d8c1f0e3d2a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e528b3f1c6d9'); // 32字节，不同的密钥！  function encryptDataWithHmac(string $data, string $encryptionKey, string $hmacKey): string {     $cipher = 'aes-256-cbc';     $ivlen = openssl_cipher_iv_length($cipher);     $iv = openssl_random_pseudo_bytes($ivlen);      $encrypted = openssl_encrypt($data, $cipher, $encryptionKey, OPENSSL_RAW_DATA, $iv);     if ($encrypted === false) {         throw new Exception('Encryption failed.');     }      // 对IV和密文生成HMAC     $hmac = hash_hmac('sha256', $iv . $encrypted, $hmacKey, true);      return base64_encode($iv . $encrypted . $hmac); }  function decryptDataWithHmac(string $encryptedData, string $encryptionKey, string $hmacKey): string {     $decoded = base64_decode($encryptedData);     if ($decoded === false) {         throw new Exception('Base64 decode failed.');     }      $cipher = 'aes-256-cbc';     $ivlen = openssl_cipher_iv_length($cipher);     $hmaclen = 32; // SHA256生成32字节的HMAC      $iv = substr($decoded, 0, $ivlen);     $ciphertext = substr($decoded, $ivlen, -($hmaclen));     $receivedHmac = substr($decoded, -($hmaclen));      if (strlen($iv) !== $ivlen || strlen($receivedHmac) !== $hmaclen) {         throw new Exception('Invalid IV or HMAC length.');     }      // 重新计算HMAC并进行时间恒定比较     $calculatedHmac = hash_hmac('sha256', $iv . $ciphertext, $hmacKey, true);     if (!hash_equals($receivedHmac, $calculatedHmac)) {         // 完整性验证失败，数据可能被篡改         throw new Exception('Data integrity check failed. Possible tampering.');     }      // HMAC验证通过，再进行解密     $decrypted = openssl_decrypt($ciphertext, $cipher, $encryptionKey, OPENSSL_RAW_DATA, $iv);     if ($decrypted === false) {         throw new Exception('Decryption failed.');     }      return $decrypted; }  // 示例使用 try {     $originalData = "这段数据用CBC加密，并用HMAC保护完整性。";     echo "原始数据: " . $originalData . "n";      $encryptedResult = encryptDataWithHmac($originalData, $encryptionKey, $hmacKey);     echo "CBC加密后的数据: " . $encryptedResult . "n";      $decryptedResult = decryptDataWithHmac($encryptedResult, $encryptionKey, $hmacKey);     echo "CBC解密后的数据: " . $decryptedResult . "n";      if ($originalData === $decryptedResult) {         echo "CBC加密解密成功，数据一致。n";     } else {         echo "CBC加密解密失败或数据不一致。n";     }      // 尝试篡改数据     $tamperedData = $encryptedResult;     $tamperedData[10] = chr(ord($tamperedData[10]) ^ 1); // 翻转一个位     try {         decryptDataWithHmac($tamperedData, $encryptionKey, $hmacKey);     } catch (Exception $e) {         echo "尝试篡改数据： " . $e->getMessage() . "n"; // 预期会报错     }  } catch (Exception $e) {     echo "发生错误: " . $e->getMessage() . "n"; } ?>