Decrypt encrypted value outside Laravel

Question

How can I decrypt a string that has been encrypted using the Laravel 4 Encrypt class, outside of Laravel, only with PHP?

Answer 1

The Laravel Encrypter class uses a Rijndael with a 256-bit block size for encryption, which is provided by the PHP Mcrypt extension. The Encrypter class works using two simple methods: encrypt() and decrypt() .

Example below:

 <?php $secret = Crypter::encrypt('some text here'); //encrypted $decrypted_secret = Crypter::decrypt($secret); //decrypted ?> 

Since you are asking how to do this "outside of Laravel":

Encryption and decryption is performed by the encrypter class. The Laravel source is publicly available, and here the relevant part:

 <?php public function encrypt($value) { $iv = mcrypt_create_iv($this->getIvSize(), $this->getRandomizer()); $value = base64_encode($this->padAndMcrypt($value, $iv)); $mac = $this->hash($iv = base64_encode($iv), $value); return base64_encode(json_encode(compact('iv', 'value', 'mac'))); } protected function padAndMcrypt($value, $iv) { $value = $this->addPadding(serialize($value)); return mcrypt_encrypt($this->cipher, $this->key, $value, $this->mode, $iv); } public function decrypt($payload) { $payload = $this->getJsonPayload($payload); $value = base64_decode($payload['value']); $iv = base64_decode($payload['iv']); return unserialize($this->stripPadding($this->mcryptDecrypt($value, $iv))); } protected function mcryptDecrypt($value, $iv) { return mcrypt_decrypt($this->cipher, $this->key, $value, $this->mode, $iv); } ?> 

For documentation and comments, see the Laravel source code on GitHub.

Hope this helps.

Answer 2

The Encrypter Laravel class is prone to change. This is due to some security vulnerabilities that have been fixed. To successfully decrypt, you need to do the following:

• Get the correct source code, for example. for 4.2.16 ;
• Ask him to work on your computer. Make sure you run the same PHP environment (using the OpenSSL extensions for the latest versions);
• Create a class in Encrypter using the correct key and, possibly, set the correct mode and algorithm;
• Finally, call decrypt .

All other necessary parameters for decryption (IV and MAC values) must be contained in the encrypted text.