1

I am writing an implementation of OpenPGP (RFC 4880) with PHP7.

GPG and PGP use the symmetric-key algorithm CAST5 (aka CAST-128) to secure private keys.

Note: please note that other symmetric-key algorithms are usable (CF RFC 4880) : IDEA, TripleDES, Blowfish, AES with 128-bit key, AES with 192-bit key, AES with 256-bit key or Twofish with 256-bit key.

Mcript implements these algorithms :

http://php.net/manual/fr/mcrypt.ciphers.php

However, Mcrypt is obsolete. We should use Sodium instead.

All right... but it seems to me that Sodium does not provide the symmetric-key algorithms mentioned above.

Note: please note that some hash algorithms seems to be missing from the Sodium implementation : MD5, SHA-1, RIPE-MD/160, SHA384, SHA224.

Am I wrong ?

If I am right, then it means to me that Sodium does not replace Mcrypt.

Thanks

Denis

Denis Kertios
  • 73
  • 1
  • 5
  • 1
    Please see [this](https://stackoverflow.com/q/41272257/238704) question. I doubt you will find a reputable package that implements CAST5 or IDEA as those are very obsolete algorithms. – President James K. Polk Jan 29 '18 at 15:26
  • You are right. It seems to me that LibSodium's purpose is to provide "high level solutions" for some tasks involving cryptography in the context of WEB programming. It is not a generic cryptographic toolbox that provides "basic building blocks" for developing cryptographic applications. – Denis Kertios Jan 29 '18 at 16:01
  • 1
    I believe that Sodium has nothing to do with PHP, it's just a third-party library for which a PHP wrapping extension has been written. Good old mcrypt extension probably died slowly for the simple reason that nobody with the required skills took care of maintaining it. So it isn't as if the PHP team designed an upgrade path to replace mcrypt with libsodium. – Álvaro González Feb 01 '18 at 08:20

1 Answers1

1

If I am right, then it means to me that Sodium does not replace Mcrypt.

No, nor was that ever the intent.

Insecure cryptography is incompatible with secure cryptography (i..e what libsodium provides). End of.

If you need to migrate, mcrypt_compat will let you decrypt messages from the old mcrypt ciphers so you can re-encrypt them with libsodium.

Scott Arciszewski
  • 33,610
  • 16
  • 89
  • 206