Can PHP's OpenSSL functions use the AES cipher with public/private keys?

1
votes

I have seen many examples of how to use AES through OpenSSL with symmetric encryption. But I am using asymmetric encryption. My webapp is storing some sensitive data encrypted with a public key, which is later only decrypted with the private key if the admin can provide the private key passphrase.

My implementation is working well, however, I am noticing very small inputs produce rather large encrypted results. For example, a 16 character input becomes 288 bytes encrypted (it decrypts to the original 16 characters). Since these encrypted results are stored in a database table, I would like to achieve encrypted values that are much closer to the input size. Predictable storage lengths is desired, too.

I am using RSA public/private keys, but what cipher does PHP's OpenSSL implementation use by default? I haven't found a single example of how to specify a cipher when using public/private keys, and the openssl_public_encrypt function doesn't allow one of the cipher constants to be specified. Am I supposed to be specifying the cipher somehow when the pub/pri keys are generated (using openssl_pkey_new)?

2
phpopensslaespublic-key-encryption

2 Answers

0
votes

AES is a symmetric encryption algorithm, it doesn't support public/private key pairs. Whoever can encrypt can also decrypt the ciphertext.

One can combine AES with an asymmetric algorithm like RSA to obtain a hybrid scheme: One uses RSA to encrypt a (random) AES key, and then uses AES to encrypt the actual data. You will still have the RSA overhead of a minimum ciphertext size of about the size of the RSA modulus (since this is RSA's output), though.

I suppose this is actually what your OpenSSL function does, maybe depending on the key type.

There are other public-key schemes, specially those based on elliptic curves, which allow a smaller size overhead for similar security as RSA. (I don't know if these are supported by OpenSSL or its PHP bindings, though.)

0
votes

I would recommend creating RSA private and public keys. See This great article