openssl_encrypt encrypts or decrypts data using a named OpenSSL cipher.
The examples explain the data format, expected results and the difference between this API and nearby cryptographic operations.
What It Does
The operation is intended for: openssl_encrypt encrypts or decrypts data using a named OpenSSL cipher.
The OpenSSL extension must be enabled.
Syntax and Return Value
openssl_encrypt(string $data, string $cipher_algo, string $passphrase, int $options = ..., string $iv = ..., $tag = ..., string $aad = ..., int $tag_length = ...): string|false| Parameter | Purpose |
|---|---|
| $data (string) | The input data bytes. Use the exact original bytes when verifying. |
| $cipher_algo (string) | Cipher algorithm choice; keep matched between encryption and decryption. |
| $passphrase (string) | Use the PHP signature above to determine the exact expected input type; validate untrusted inputs before calling. |
| $options (int) | Driver or algorithm-specific options; avoid unchecked user-controlled settings. |
| $iv (string) | Initialization vector or nonce whose length must match the selected cipher. |
| $tag (mixed) | Use the PHP signature above to determine the exact expected input type; validate untrusted inputs before calling. |
| $aad (string) | Use the PHP signature above to determine the exact expected input type; validate untrusted inputs before calling. |
| $tag_length (int) | Use the PHP signature above to determine the exact expected input type; validate untrusted inputs before calling. |
The declared return type is shown above. Errors can include false results or exceptions depending on this API: For AES-GCM, transmit and verify the authentication tag and never reuse a nonce with the same key; do not treat unauthenticated CBC encryption as tamper-proof.
Example 1: Basic Operation
Authenticated GCM requires checking the authentication tag; a fresh nonce is essential.
<?php
$plaintext = "annual report";
$key = random_bytes(32);
$nonce = random_bytes(12);
$ciphertext = openssl_encrypt($plaintext, "aes-256-gcm", $key, OPENSSL_RAW_DATA, $nonce, $tag);
echo strlen($ciphertext) . " bytes, tag=" . strlen($tag);Example 2: A Different Use Case
Authenticated GCM requires checking the authentication tag; a fresh nonce is essential.
<?php
// Check the alternative case.
$plaintext = "invoice 42";
$key = random_bytes(32);
$nonce = random_bytes(12);
$ciphertext = openssl_encrypt($plaintext, "aes-256-gcm", $key, OPENSSL_RAW_DATA, $nonce, $tag);
echo strlen($ciphertext) . " bytes, tag=" . strlen($tag);Practical Example: Checking the Result
Authenticated GCM requires checking the authentication tag; a fresh nonce is essential.
<?php
// Verify the expected behavior before using results.
$plaintext = "signed event";
$key = random_bytes(32);
$nonce = random_bytes(12);
$ciphertext = openssl_encrypt($plaintext, "aes-256-gcm", $key, OPENSSL_RAW_DATA, $nonce, $tag);
echo strlen($ciphertext) . " bytes, tag=" . strlen($tag);Important Behavior and Edge Cases
For AES-GCM, transmit and verify the authentication tag and never reuse a nonce with the same key; do not treat unauthenticated CBC encryption as tamper-proof.
For AES-GCM, transmit and verify the authentication tag and never reuse a nonce with the same key; do not treat unauthenticated CBC encryption as tamper-proof.
Comparison with Related Functions
| Approach | Key distinction |
|---|---|
| openssl_encrypt | openssl_encrypt encrypts or decrypts data using a named OpenSSL cipher. |
| Related technique | sodium_crypto_secretbox is often simpler for authenticated symmetric encryption. |
Common Beginner Mistakes
| Mistake | Correct approach |
|---|---|
| Confusing this operation with a neighboring cryptographic or security mechanism | sodium_crypto_secretbox is often simpler for authenticated symmetric encryption. |
| Ignoring a security prerequisite or failure case | For AES-GCM, transmit and verify the authentication tag and never reuse a nonce with the same key; do not treat unauthenticated CBC encryption as tamper-proof. |
Key Takeaways
- openssl_encrypt encrypts or decrypts data using a named OpenSSL cipher.
- For AES-GCM, transmit and verify the authentication tag and never reuse a nonce with the same key; do not treat unauthenticated CBC encryption as tamper-proof.
- sodium_crypto_secretbox is often simpler for authenticated symmetric encryption.
Apply this behavior to a real application only after confirming the required extension, configuration and failure handling on the deployment runtime.