Two-way encryption in PHP

Question

My application (obviously) uses a unique ID to distinguish records. This UID is passed in URLs (e.g. ./examplepage.php?UID=$example_int), among other things.

While I obviously have server-side validation in place to make sure clients don't access other clients' data, is there a two-way encryption method I can use in PHP to only pass encrypted UIDs (e.g. ./examplepage.php?EUID=$encrypted_int), to further reduce the chance of anyone thinking "hey, what happens if I increment this integer?"

TIA.

Answer 1

Placing a hash next to the ID to ensure it's security, or padding the ID with extra data, or even converting the ID to hex would all work fairly well I think.

Answer 2

Knock yourself out with crypt:

http://us.php.net/manual/en/function.crypt.php

Answer 3

While PHP supports many two way hashing algorithms I do not see it being useful in this example. What you need to do is:

1. Load the row from storage by the provided id
2. Check that the owner of the row is the authenticated user and if not throw an exception and inform the user not to do that again

But if your heart is set on hashing just pick one of the algorithms provided.

Answer 4

For two-way encryption check mcrypt, or if you prefer a pure implementation phpseclib.

Answer 5

You don't need two-way encryption - encryption is for maintaining secrecy, but what you're really looking for here is authenticity.

HMACs (essentially, keyed hashes) are one way of getting cryptographic authenticity. Accompany the UID with a HMAC of the UID (PHP has a HMAC implementation), using a key that only the server knows. At the start of each request, check the HMAC.

Basically, use the right tool for the right job.