Encrypting uploaded files in PHP

sameer — Sun, 07 Nov 2010 13:19:07 +0000

During a recent project, the client requested that uploaded files be encrypted for security reasons. As I already had the uploaded code ready and tested I just needed to add some extra encryption capability to the code. As earlier I’d encountered Zends wonderful Zend_Filter class, I decided to go with it and use the Zend_Filter_Encrypt and Zend_Filter_Decrypt to accomplish the work. The Zend_Filter component provides a set of common useful data filters, among which are the encryption filters. Although my project was not developed in Zend, I could easily integrate the required classes in the code. Note that Zend has a great upload library, Zend_File_Transfer, that lets you easily manage file uploading and also encryption, but as I already had the upload code tested, I decided to just add the encryption part.

Downloading the Zend framework

As the following code requires the Zend framework make sure you download it first. For this code I used Zend 1.11.0 Full version. You can also download the required files at the end of this post.

Which Zend framework files do I need

You only need some selected files to make the below code work. The following is a list of files and directories that I used from the ‘ZendFramework-1.11.0\library\Zend’ directory. The top three in the list are directories. There are also many files in the ‘Filter’ directory that are not required, but for keeping it simple we will use the whole thing.

File (dir)
Filter (dir)
Loader (dir)
Loader.php
Filter.php
Exception.php

Encrypting uploaded files

For the following example I’ve not included the file uploading code. I assume you already have the upload code ready. You can also use the following code by itself to encrypt/decrypt files. The program for file encryption is shown below.


 
/* Load the Zend file encrypting filter */
require_once('./Zend/Filter/File/Encrypt.php');
 
/*  Set various encryption options. */
$options = array(
                // Encryption type - Openssl or Mcrypt
                'adapter' => 'mcrypt', 
                // Initialization vector
                'vector' => '236587hgtyujkirtfgty5678', 
                // Encryption algorithm
                'algorithm' => 'rijndael-192', 
                // Encryption key
                'key' => 'KFJGKDK$$##^FFS345678FG2' 
                );
 
/* Initialize the library and pass the options */
$encrypt = new Zend_Filter_File_Encrypt($options);
 
/* 
   Set output filename, where the encrypted file will be stored.
   If we omit this, the encrypted file will overwrite the original file.
*/
$filter->setFilename('test.enc.pdf');
 
/* Now encrypt a file */
$encrypt->filter('test.pdf');
 
?>

Decrypting the encrypted files is as simple as above. Note that you need to keep the ‘vector’ and ‘key’ values the same as you used for encryption, or you will not be able to correctly decrypt the file.


 
/* Load the Zend file decrypting filter */
require_once('./Zend/Filter/File/Decrypt.php');
 
/*  Set various decryption options. */
$options = array(
                // Encryption type - Openssl or Mcrypt
                'adapter' => 'mcrypt', 
                // Initialization vector
                'vector' => '236587hgtyujkirtfgty5678', 
                // Decryption algorithm
                'algorithm' => 'rijndael-192', 
                // Decryption key
                'key' => 'KFJGKDK$$##^FFS345678FG2' 
                );
 
/* Initialize the library and pass the options */
$decrypt = new Zend_Filter_File_Decrypt($options);
 
/* 
   Set output filename, where the decrypted file will be stored.
*/
$filter->setFilename('test.pdf');
 
/* Now decrypt the previously encrypted file */
$decrypt->filter('test.enc.pdf');
 
?>

Selecting a encryption algorithm

In the example given I’ve used the rijndael-192 (AES) algorithm but you can choose some other according to the availability. ‘rijndael’ is fine for most requirements. First you will need to know what algorithms are supported by your installation. A quick way to find out is to use the following code.


 
    $algorithms = mcrypt_list_algorithms();
 
    foreach ($algorithms as $cipher) {
        echo "$cipher
\n";
    }
 
?>

On my system it lists the following algorithms.

cast-128 , gost , rijndael-128 , twofish , arcfour , cast-256 , loki97 , rijndael-192 , saferplus , wake , blowfish-compat , des , rijndael-256 , serpent , xtea , blowfish , enigma , rc2 , tripledes.

Selecting a random Initialization vector

Before we continue our discussion, a brief overview of Initialization vector (IV). An IV is a random string that can be used along with a key for data encryption. IV is used to prevent a sequence of text that is identical to a previous sequence from producing the same exact cipher-text when encrypted.

As you can see from the example code we have used a fixed IV. The disadvantage of this is that there is a possibility that a committed hacker would be able to guess the IV by studying the pattern in the encrypted files and thus break the encryption. The best way then is to let the class generate a random IV for each new encryption. This requires a little change of code, as shown below. The only extra step we now require is to store the generated random IV in a database which will then be used for decryption.

Encryption:


 
/* Load the Zend file encrypting filter */
require_once('./Zend/Filter/File/Encrypt.php');
 
/*  Set various encryption options. */
$options = array(
                // Encryption type - Openssl or Mcrypt
                'adapter' => 'mcrypt', 
                // Encryption algorithm
                'algorithm' => 'rijndael-192', 
                // Encryption key
                'key' => 'KFJGKDK$$##^FFS345678F54' 
                );
 
/* Initialize the library and pass the options */
$filter = new Zend_Filter_File_Encrypt($options);
 
/* Generate a random vector */
$filter->setVector();
 
/* Set output filename, where the encrypted file will be stored. */
$filter->setFilename('test.enc.pdf');
 
/* Now encrypt a file */
$filter->filter('test.pdf');
 
/* 
    Save the vector in a DB or somewhere else,
    we will need this during decryption
*/
$vector = $filter->getVector();
 
?>

Decryption:


 
/* Load the Zend file decrypting filter */
require_once('./Zend/Filter/File/Decrypt.php');
 
/*  Set various encryption options. */
$options = array(
                // Encryption type - Openssl or Mcrypt
                'adapter' => 'mcrypt', 
                // Encryption algorithm
                'algorithm' => 'rijndael-192', 
                // Encryption key
                'key' => 'KFJGKDK$$##^FFS345678F54' 
                );
 
/* Initialize the library and pass the options */
$filter = new Zend_Filter_File_Decrypt($options);
 
/* 
   Use the saved vector for decryption.
   Note that using a wrong vector will result in a incorrect decryption.
*/
$filter->setVector('your-saved-vector');
 
/* Set output filename, where the decrypted file will be stored. */
$filter->setFilename('test.dec.pdf');
 
/* Now decrypt the previously encrypted file */
$filter->filter('test.enc.pdf');
 
?>

Selecting the correct ‘vector’ and ‘key’ size

Before you run the code make sure that you set your PHP error reporting to ‘E_ALL’. Mcrypt requires that you use a correct IV and key length, which depends on which algorithm is used. Selecting a wrong IV (if you are using a fixed IV) or key length can generate the following error, which if the errors are disabled will be hidden and you will keep wondering as to why the files are not getting encrypted.:

- in case of a wrong vector length:

Fatal error: Uncaught exception ‘Zend_Filter_Exception’ with message ‘The given vector has a wrong size for the set algorithm’

- in case of a wrong key length:

Fatal error: Uncaught exception ‘Zend_Filter_Exception’ with message ‘The given key has a wrong size for the set algorithm’

To get the correct sizes use the following code. I’ve used ‘rijndael-192′ algorithm here, but you need to substitute whatever algorithm you have selected instead.


 
$cipher = mcrypt_module_open('rijndael-192', '', 'ofb', '');
$vector_size = mcrypt_enc_get_iv_size($cipher);
$key_size = mcrypt_enc_get_supported_key_sizes($cipher);
print_r($vector_size);
echo "\n";
print_r($key_size);
 
?>

Which on my machine returns the following.

24
 
Array
(
    [0] => 16
    [1] => 24
    [2] => 32
)

So if the IV size returns ’24′ then you need to use a random string of 24 character for the Initialization Vector (IV). The key length can be any from the returned values, 16, 24 or 32.

Downloading encrypted file

To round-off the post, I’ve included code to download a encrypted file via a link, which will be decrypted and passed to the user. For example you can call the download link as below:

http://www.site.com/download-file.php?docname=test.enc.pdf

The code for ‘download-file.php’ is shown below. The code is a bit simplified, for e.g no security validation is done on the $_GET variable.


 
/* download-file.php */
 
/* 
   The constants UPLOAD_PATH, TEMP_PATH, INIT_VECTOR, ENCRYPTION_KEY
   have to be changed to your particular setup.
*/
 
require_once('Zend/Filter/File/Decrypt.php');
 
$docname = $_GET['docname'];
 
$filename = UPLOAD_PATH . $docname;
$destination = TEMP_PATH . $docname;
 
if(!file_exists($filename)) {
    echo "Error accessing the file.";
    exit();
}
 
/* Copy encrypted file to a temporary folder */
if (!copy($filename, $destination)) {
    die("Error accessing file");
}
 
 /* Zend file decryption */
$filter = new Zend_Filter_File_Decrypt(
                array('adapter'     => 'mcrypt',
                      'vector'      => INIT_VECTOR,
                      'algorithm'   => 'rijndael-192',
                      'key'         => ENCRYPTION_KEY
                      ));
 
$filter->filter($destination);
 
 
$fp = @fopen($destination, 'rb');
 
if (strstr($_SERVER['HTTP_USER_AGENT'], "MSIE"))
{
    header('Content-Type: "application/octet-stream"');
    header('Content-Disposition: attachment; filename="'.$docname.'"');
    header('Expires: 0');
    header('Cache-Control: must-revalidate, post-check=0, pre-check=0');
    header("Content-Transfer-Encoding: binary");
    header('Pragma: public');
    header("Content-Length: ".filesize($destination));
}
else
{
    header('Content-Type: "application/octet-stream"');
    header('Content-Disposition: attachment; filename="'.$docname.'"');
    header("Content-Transfer-Encoding: binary");
    header('Expires: 0');
    header('Pragma: no-cache');
    header("Content-Length: ".filesize($destination));
}
 
fpassthru($fp);
fclose($fp);
 
/* Delete the copied decrypted from the temp folder */
unlink($destination);
 
?>

Creating a Figlet text in php

sameer — Tue, 18 Nov 2008 12:21:27 +0000

Zend_Text_Figlet is a Zend component which enables developers to create a FIGlet text. A Figlet is nothing but a technique of creating large letters using ordinary text. I don’t know how to make a use of this in my daily matters, but its a nice recreation. A short history on Figlet can be found here. An example and the code to generate it is shown below.

  ____     __   _     ____
 |  _ \\  | || | ||  |  _ \\
 | |_| || | '--' ||  | |_| ||
 | .__//  | .--. ||  | .__//
 |_|--`   |_|| |_||  |_|--`
 `-`      `-`  `-`   `-`


 
require_once("zend/text/figlet.php");
$figlet = new Zend_Text_Figlet();
echo $figlet->render('PHP');
 
?>

If you are displaying the output on a web page make sure to use the ‘pre’ tags around the Figlet. The Figlet looks good in a pure text format.
You can also define various options for the Figlet by passing the function an array of options, like say changing the font.


 
require_once("zend/text/figlet.php");
/* use a different font */
$options = array('font' => 'graffiti.flf');               
 
$figlet = new Zend_Text_Figlet($options);
echo $figlet->render('PHP');
 
?>

__________   ___ ___  __________
\______   \ /   |   \ \______   \
 |     ___//    ~    \ |     ___/
 |    |    \    Y    / |    |
 |____|     \___|_  /  |____|
                  \/

You can download more fonts from here.
The default width of the Figlet output is set to 80 characters, which you can change with the ‘outputWidth’ option.

.
.
$options = array('outputWidth' => 120);

For more options you can take a look at the documentation.

Zend framework map for version 1.5

sameer — Tue, 08 Apr 2008 06:12:51 +0000

Zend framework is gaining widespread use everyday. Each new version of the framework includes new component additions. The following shows a visual representation of the Zend framework for version 1.5.
The following image was created using Microsoft Visio and then exported to PDF. I’ll be adding a linked map page soon. Click on the image for a larger view, or download a PDF version here.

Download PDF version (color)
Download PDF version (Grayscale)

Delicious tag cloud using Zend framework

sameer — Mon, 07 Apr 2008 05:19:43 +0000

Zend framework provides many interesting wrappers for major service APIs like Akismet, Amazon, Audioscrobbler, Delicious, Flickr, Nirvanix, etc.

In this post we will use the delicious wrapper to create a tag cloud for your delicious account.

Now that we have all the tags with us we will display them as a cloud with weight attached to each tag. The font size of each tag will be set depending on the number of posts for that particular tags. For e.g a tag named “php” having 45 posts will have the font size set to 30 px while a tag “flash” having 2 posts will have the font size set to 10 px.

Here’s what the output will look like. The tags visited are in blue.

Download code

code-diesel » zend