This post is part of a series about symmetric encryption with AES-256 in PHP.

Table of contents:

  1. Encrypting text
  2. Decrypting text
  3. Encrypting files
  4. Decrypting files

After encrypting text in the previous post, we now want to be able to decrypt that as well.

First things first – here’s the code:

Copy to Clipboard

Our decrypt function only needs two parameters: an encrypted message and a secret. Since IV, salt and signature are embedded in the message, this is all it takes.

We start by checking if we actually got something to decrypt, as we would run into nasty errors later, if we didn’t.
Next we extract the HMAC-signature from the message. If there is none, `$hmac` will simply not be set.

Decoding

In any case we will have our Base64-encoded IV-salt-cipertext-composition in the `$separated`-array. After we reversed the url-safe Base64 encoding with this little piece of code

Copy to Clipboard

we can extract IV, salt and the actual ciphertext. This is easy because we know their individual positions in the string.

Generating a key

With key and salt in place we can now generate a key again using the same parameters we used when encrypting. What we’ll get is a key that is equal to the one we previously generated.

Verifying the signature

If we found a signature above, we re-sign the given ciphertext and use `hash_equals` to check if it matches the signature provided to ensure integrity. We use `hash_equals` in favour of a simple string comparison to mitigate timing attacks.

Decrypting

All that’s left to do is to pass all those ingrediences to the `openssl_decrypt`, let that magic happen in the background and get back our plaintext in return.