【PHP】对称加密算法 AES-256-GCM 代码示例

前言

下面介绍在PHP代码中，如何对数据进行 AES-256-GCM 加密和解密。我们可以使用 openssl 和 sodium 扩展来实现加密，它们都支持 AES-256-GCM 算法，下面将给出两种扩展的代码示例。

注：在对称加密算法中，除了应用广泛的 AES 以外，还有一种名为 ChaCha20-Poly1305 的新式加密算法，它的性能比 AES 更好（如果CPU支持AES指令硬件加速，则AES性能更好），安全性也不输AES。sodium 扩展支持 ChaCha20-Poly1305。

环境

PHP 7.3

一、使用openssl扩展

<?phpfunction aes256gcm_encrypt(string $data, string $keygen, string $aad = ''): array
{$cipher = 'aes-256-gcm';$ivLen = openssl_cipher_iv_length($cipher);$iv = random_bytes($ivLen); // 12字节的iv$encrypt = openssl_encrypt($data, $cipher, $keygen, OPENSSL_RAW_DATA, $iv,$tag, $aad);return ['iv'          => base64_encode($iv),'tag'         => base64_encode($tag),'aad'         => base64_encode($aad),'cipher_text' => base64_encode($encrypt),];
}function aes256gcm_decrypt(array $secretData, string $keygen)
{$iv = base64_decode($secretData['iv']);$tag = base64_decode($secretData['tag']);$aad = base64_decode($secretData['aad']);$cipherText = base64_decode($secretData['cipher_text']);$cipher = 'aes-256-gcm';return openssl_decrypt($cipherText, $cipher, $keygen, OPENSSL_RAW_DATA, $iv, $tag, $aad);
}function main()
{// AES-256-GCM需要32字节的密钥$keygen = bin2hex(random_bytes(16));// 加密$data = 'Hello World!';$secretData = aes256gcm_encrypt($data, $keygen, 'foobar');// 解密$plainText = aes256gcm_decrypt($secretData, $keygen);echo "原文：$data\n";echo "密文数据：" . json_encode($secretData) . "\n";echo "解密后：$plainText\n";
}main();

二、使用 sodium 扩展

<?phpfunction aes256gcm_encrypt(string $data, string $keygen, string $aad = ''): array
{$iv = random_bytes(SODIUM_CRYPTO_AEAD_AES256GCM_NPUBBYTES);$encrypt = sodium_crypto_aead_aes256gcm_encrypt($data, $aad, $iv, $keygen); // 包含密文、tagreturn ['iv'          => sodium_bin2base64($iv, SODIUM_BASE64_VARIANT_ORIGINAL),'aad'         => sodium_bin2base64($aad, SODIUM_BASE64_VARIANT_ORIGINAL),'cipher_text' => sodium_bin2base64($encrypt, SODIUM_BASE64_VARIANT_ORIGINAL),];
}function aes256gcm_decrypt(array $secretData, string $keygen)
{$iv = sodium_base642bin($secretData['iv'], SODIUM_BASE64_VARIANT_ORIGINAL);$aad = sodium_base642bin($secretData['aad'], SODIUM_BASE64_VARIANT_ORIGINAL);$cipherText = sodium_base642bin($secretData['cipher_text'], SODIUM_BASE64_VARIANT_ORIGINAL);return sodium_crypto_aead_aes256gcm_decrypt($cipherText, $aad, $iv, $keygen);
}function main()
{if (!sodium_crypto_aead_aes256gcm_is_available()) {exit('Not support AES-256-GCM');}// 生成AES-256-GCM的密钥$keygen = sodium_crypto_aead_aes256gcm_keygen();// 加密$data = 'Hello World!';$secretData = aes256gcm_encrypt($data, $keygen, 'foobar');// 解密$plainText = aes256gcm_decrypt($secretData, $keygen);echo "原文：$data\n";echo "密文数据：" . json_encode($secretData) . "\n";echo "解密后：$plainText\n";
}main();