In the Encrypt module, can I switch between phpseclib and mcrypt assuming I keep the Key Provider Settings in place?
No. You cannot just switch out the encryption methods. Mcrypt AES (CBC Mode) pads the input and also prepends two salts and an IV as well other information like the HMAC for authentication in it's output. phpseclib does none of this. Here are some examples:

encrypt('all your base');
// $text = "TUsE3Fwzvj6MT41ritVO/zUuJ/qWNmZJIBU3euDEX9iDMb3IqMyTJEFwssW/SI/GZ8ce/HxqrqPFWGzTNC0d7UZUtRjr2JReoqaCqw18GHyGhbjqr1zZbr/MCIT1rENM";

encrypt('all your base', array(), 'phpseclib');
// $text = "1r/WWYiCW9icZ93iUxStMQ==";


You can actually rewrite the existing mcrypt plugin to use phpseclib instead. You wouldn't necessarily need the HMAC stuff—it's there for added benefit but you can just skip it. But you likely could make a pain-free transition.

For example, replacing the existing decryption code in _encrypt_encryption_methods_mcrypt_aes_cbc():

// Initialize for decryption.
mcrypt_generic_init($mcrypt, $ekey, $iv);

// Decrypt the data.
$processed_text = mdecrypt_generic($mcrypt, $text);

// Terminate decryption.
mcrypt_generic_deinit($mcrypt);

// Remove any padding.
$pad = ord($processed_text[strlen($processed_text) - 1]);
$processed_text = substr($processed_text, 0, -$pad);

// Close the Mcrypt handle.
mcrypt_module_close($mcrypt);


With this rewrite:

$path = libraries_get_path('phpseclib');
require_once $path . '/Crypt/AES.php';
$aes = new Crypt_AES();
$aes-&gt;setIV($iv);
$aes-&gt;setKey($ekey);
$processed_text = $aes-&gt;decrypt($text);


Returns the correct plain-text given the original mcrypt encryption ciphertext. At least, it should. I've got mcrypt on my system and so phpseclib is probably using it, but it should "just work" for you.

Oh yeah, FYI, use phpseclib 1.x. As the 2.x branch will not work.