PHP如何实现数据加密_数据加密与解密完整指南

openssl

password_hash

openssl

<?php

class DataEncryptor

{

    private string $cipherAlgo;

    private string $key;

    public function __construct(string $key, string $cipherAlgo = aes-256-gcm)

    {

        if (empty($key)) {

            throw new InvalidArgumentException("Encryption key cannot be empty.");

        }

        if (!in_array($cipherAlgo, openssl_get_cipher_methods())) {

            throw new InvalidArgumentException("Cipher algorithm {$cipherAlgo} is not supported.");

        }

        $this->key = $key;

        $this->cipherAlgo = $cipherAlgo;

    }

    /**

     * 加密数据

     * @param string $data 待加密的原始数据

     * @return string 加密后的数据（base64编码），包含IV和Tag

     * @throws Exception 如果加密失败

     */

    public function encrypt(string $data): string

    {

        $ivLen = openssl_cipher_iv_length($this->cipherAlgo);

        if ($ivLen === false) {

            throw new Exception("Failed to get IV length for {$this->cipherAlgo}.");

        }

        $iv = openssl_random_pseudo_bytes($ivLen);

        if ($iv === false) {

            throw new Exception("Failed to generate IV.");

        }

        $tag = ; // GCM模式需要一个tag

        $encryptedData = openssl_encrypt($data, $this->cipherAlgo, $this->key, OPENSSL_RAW_DATA, $iv, $tag);

        if ($encryptedData === false) {

            throw new Exception("Encryption failed: " . openssl_error_string());

        }

        // 将IV、加密数据和Tag拼接并进行base64编码，方便存储和传输

        // IV在前，加密数据在中间，Tag在后

        return base64_encode($iv . $encryptedData . $tag);

    }

    /**

     * 解密数据

     * @param string $encryptedDataBase64 经过base64编码的加密数据

     * @return string 解密后的原始数据

     * @throws Exception 如果解密失败或数据被篡改

     */

    public function decrypt(string $encryptedDataBase64): string

    {

        $decodedData = base64_decode($encryptedDataBase64, true);

        if ($decodedData === false) {

            throw new Exception("Base64 decoding failed.");

        }

        $ivLen = openssl_cipher_iv_length($this->cipherAlgo);

        if ($ivLen === false) {

            throw new Exception("Failed to get IV length for {$this->cipherAlgo}.");

        }

        // 从解码后的数据中分离IV、加密数据和Tag

        $iv = substr($decodedData, 0, $ivLen);

        $tag = substr($decodedData, -16); // GCM模式的Tag通常是16字节

        $encryptedData = substr($decodedData, $ivLen, -16);

        if (strlen($iv) !== $ivLen) {

             throw new Exception("Invalid IV length.");

        }

        if (strlen($tag) !== 16) { // 假设GCM Tag是16字节

             throw new Exception("Invalid Tag length.");

        }

        $decryptedData = openssl_decrypt($encryptedData, $this->cipherAlgo, $this->key, OPENSSL_RAW_DATA, $iv, $tag);

        if ($decryptedData === false) {

            throw new Exception("Decryption failed or data was tampered: " . openssl_error_string());

        }

        return $decryptedData;

    }

    /**

     * 生成一个安全的随机密钥

     * @param int $length 密钥长度（字节），对于AES-256，通常是32字节

     * @return string

     * @throws Exception

     */

    public static function generateKey(int $length = 32): string

    {

        $key = openssl_random_pseudo_bytes($length);

        if ($key === false) {

            throw new Exception("Failed to generate random key.");

        }

        return $key;

    }

}

// 示例使用

try {

    // 1. 生成一个安全的密钥 (在实际应用中，密钥应该从安全的地方加载，而不是每次运行时生成)

    $encryptionKey = DataEncryptor::generateKey(32); // AES-256 需要32字节密钥

    // 假设我们把这个密钥存储在一个环境变量中或者安全配置文件里

    // $encryptionKey = getenv(APP_ENCRYPTION_KEY);

    $encryptor = new DataEncryptor($encryptionKey);

    $originalData = "这是一段需要加密的敏感信息，比如用户的个人资料或支付数据。";

    echo "原始数据: " . $originalData . PHP_EOL;

    // 2. 加密数据

    $encryptedResult = $encryptor->encrypt($originalData);

    echo "加密后的数据 (Base64编码): " . $encryptedResult . PHP_EOL;

    // 3. 解密数据

    $decryptedResult = $encryptor->decrypt($encryptedResult);

    echo "解密后的数据: " . $decryptedResult . PHP_EOL;

    // 验证是否一致

    if ($originalData === $decryptedResult) {

        echo "加密解密成功，数据一致。" . PHP_EOL;

    } else {

        echo "加密解密失败，数据不一致！" . PHP_EOL;

    }

    // 尝试篡改数据（模拟攻击）

    echo PHP_EOL . "--- 模拟数据篡改 ---" . PHP_EOL;

    $tamperedEncryptedResult = substr($encryptedResult, 0, -5) . AAAAA; // 篡改最后几个字符

    try {

        $encryptor->decrypt($tamperedEncryptedResult);

    } catch (Exception $e) {

        echo "解密篡改数据失败，符合预期: " . $e->getMessage() . PHP_EOL;

    }

} catch (Exception $e) {

    echo "错误: " . $e->getMessage() . PHP_EOL;

}

// 对于密码存储，请使用 password_hash 和 password_verify

echo PHP_EOL . "--- 密码哈希示例 ---" . PHP_EOL;

$userPassword = "MySecurePassword123";

$hashedPassword = password_hash($userPassword, PASSWORD_BCRYPT); // 使用bcrypt算法

echo "用户密码: " . $userPassword . PHP_EOL;

echo "哈希后的密码: " . $hashedPassword . PHP_EOL;

if (password_verify($userPassword, $hashedPassword)) {

    echo "密码验证成功。" . PHP_EOL;

} else {

    echo "密码验证失败。" . PHP_EOL;

}

// 尝试错误密码

if (password_verify("WrongPassword", $hashedPassword)) {

    echo "错误密码验证成功 (不应该发生)！" . PHP_EOL;

} else {

    echo "错误密码验证失败，符合预期。" . PHP_EOL;

}

?>

openssl

openssl

md5()

sha1()

hash()

password_hash()

password_verify()

bcrypt

Argon2

password_hash

openssl_encrypt

openssl_decrypt

openssl_public_encrypt

openssl_private_decrypt