Php encrypt file with password

I did a series of research on this topic, but unfortunately I couldn't find a perfect way to encrypt and decrypt files in PHP. Which mean what I'm trying to do is find some way to encrypt & decrypt my items without worry of cracker knew my algorithm. If some algorithm that need to secrete & hide, it can't solve my problems while once the logic shared through anywhere, or they broke into my server and get the source file, then it should be some way to decrypt it using the same decryption algorithm. Previously I found several great posts on StackOverFlow website, but it still couldn't answer my question.

The best way to encrypt password of the world, from what I conclude through reading. Blowfish encryption. It's one way hashing algorithm with 1000's times iteration which make cracker need 7 years to decrypt by using the same specification GPU.

Obviously, this makes it impossible to decrypt while it's one-way hashing.

1. How do you use bcrypt for hashing passwords in PHP?
2. Why do salts make dictionary attacks 'impossible'?

The best way to encrypt and decrypt password in PHP, as this question quote as it is. Refer to what I found through the web, sha1 and md5 both are cracked & broken algorithm, even we change the algorithm from

$encrypted = base64_encode[mcrypt_encrypt[MCRYPT_RIJNDAEL_256, md5[$key], $string, MCRYPT_MODE_CBC, md5[md5[$key]]]];

To

$encrypted = base64_encode[mcrypt_encrypt[MCRYPT_RIJNDAEL_256, sha1[md5[$key]], $string, MCRYPT_MODE_CBC, sha1[md5[md5[$key]]]]];

Are not it's just increasing the toughness to decrypt it but still crack-able while just time issue ?

1. Best way to use PHP to encrypt and decrypt passwords?

I'm thinking of using our server processor / harddisc GUID to generate the salt and encrypt the password.

It's still some stupid way to do while cracker got the access to the server and they can just use PHP to echo the GUID and do the decryption. Or if it works, a few years later my website will be in trouble. The reason is harddisc, processor never last forever. When the time my processor or harddisc down, it's a time when my website down and lost all the credential.

Update

Found this question which doing with blowfish for decryption in PHP. Is it solving the question of finding secured way to encrypt and hard to decrypt by others ?

1. How to decrypt using Blowfish algorithm in php?

Can anyone please suggest on how should I overcome this issue ? Thanks.

asked Aug 20, 2012 at 4:16

14

Checkout this well documented article A reversible password encryption routine for PHP, intended for those PHP developers who want a password encryption routine that is reversible.

Even though this class is intended for password encryption, you can use it for encryption/decryption of any text.

function encryption_class[] {
    $this->errors = array[];

    // Each of these two strings must contain the same characters, but in a different order.
    // Use only printable characters from the ASCII table.
    // Do not use single quote, double quote or backslash as these have special meanings in PHP.
    // Each character can only appear once in each string.
    $this->scramble1 = '! #$%&[]*+,-./0123456789:;?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[]^_`abcdefghijklmnopqrstuvwxyz{|}~';
    $this->scramble2 = 'f^jAE]okIOzU[2&q1{3`h5w_794p@6s8?BgP>dFV=m D