In the Encrypt module, can I switch between phpseclib and mcrypt assuming I keep the Key Provider Settings in place? A client uses the encrypt module as the basis to encrypt some database cells. The current server is RHEL 6/PHP 5.3. They're upgrading to RHEL 7 but will push to PHP 5.6. 

The Encrypt module asks for either a method:


PHP Secure Communications Library (phpseclib) 
Mcrypt AES (CBC Mode) 
None


Currently the client had the second choice selected. However, the php-mcrypt package doesn't exist in PHP 5.6, and from my understanding, it itself hasn't been updated in a while. The alternative of installing the Libraries Module and cloning down a copy of phpseclib from git clone https://github.com/phpseclib/phpseclib.git seems more palatable at the moment. 

Question: can I switch out to using phpseclib assuming I keep the Key Provider Settings in place?
No. You cannot just switch out the encryption methods. Mcrypt AES (CBC Mode) pads the input and also prepends two salts and an IV as well other information like the HMAC for authentication in it's output. phpseclib does none of this. Here are some examples:

encrypt('all your base');
// $text = "TUsE3Fwzvj6MT41ritVO/zUuJ/qWNmZJIBU3euDEX9iDMb3IqMyTJEFwssW/SI/GZ8ce/HxqrqPFWGzTNC0d7UZUtRjr2JReoqaCqw18GHyGhbjqr1zZbr/MCIT1rENM";

encrypt('all your base', array(), 'phpseclib');
// $text = "1r/WWYiCW9icZ93iUxStMQ==";


You can actually rewrite the existing mcrypt plugin to use phpseclib instead. You wouldn't necessarily need the HMAC stuff—it's there for added benefit but you can just skip it. But you likely could make a pain-free transition.

For example, replacing the existing decryption code in _encrypt_encryption_methods_mcrypt_aes_cbc():

// Initialize for decryption.
mcrypt_generic_init($mcrypt, $ekey, $iv);

// Decrypt the data.
$processed_text = mdecrypt_generic($mcrypt, $text);

// Terminate decryption.
mcrypt_generic_deinit($mcrypt);

// Remove any padding.
$pad = ord($processed_text[strlen($processed_text) - 1]);
$processed_text = substr($processed_text, 0, -$pad);

// Close the Mcrypt handle.
mcrypt_module_close($mcrypt);


With this rewrite:

$path = libraries_get_path('phpseclib');
require_once $path . '/Crypt/AES.php';
$aes = new Crypt_AES();
$aes-&gt;setIV($iv);
$aes-&gt;setKey($ekey);
$processed_text = $aes-&gt;decrypt($text);


Returns the correct plain-text given the original mcrypt encryption ciphertext. At least, it should. I've got mcrypt on my system and so phpseclib is probably using it, but it should "just work" for you.

Oh yeah, FYI, use phpseclib 1.x. As the 2.x branch will not work.