openssl_public_decrypt
(PHP 4 >= 4.0.6, PHP 5, PHP 7, PHP 8)
openssl_public_decrypt — 公開鍵でデータを復号する
説明
openssl_public_decrypt(
string
#[\SensitiveParameter] string
OpenSSLAsymmetricKey|OpenSSLCertificate|array|string
int
): bool
string
$data,#[\SensitiveParameter] string
&$decrypted_data,OpenSSLAsymmetricKey|OpenSSLCertificate|array|string
$public_key,int
$padding = OPENSSL_PKCS1_PADDING): bool
openssl_public_decrypt() は、事前に
openssl_private_encrypt() で暗号化された
data を復号し、それを
decrypted_data に格納します。
これを使用するのは、例えばメッセージの作者が秘密鍵の所有者であるかどうかを調べる場合です。
パラメータ
data-
decrypted_data-
public_key-
public_keyは、 データの暗号化に使用した秘密鍵と対になる公開鍵である必要があります。 padding-
paddingにはOPENSSL_PKCS1_PADDINGあるいはOPENSSL_NO_PADDINGが指定可能です。
変更履歴
| バージョン | 説明 |
|---|---|
| 8.0.0 |
public_key は、
OpenSSLAsymmetricKey または
OpenSSLCertificate クラスのインスタンスを受け入れるようになりました。
これより前のバージョンでは、
OpenSSL key または
OpenSSL X.509 型のリソースを受け入れていました。
|
＋add a note
User Contributed Notes 1 note
Hernanibus ¶
8 years ago
Just a little note on [P.Peyremorte]'s note in manual's openssl_private_encrypt.
"- openssl_private_encrypt can encrypt a maximum of 117 chars at one time."
This depends on the length of $key:
- For a 1024 bit key length => max number of chars (bytes) to encrypt = 1024/8 - 11(when padding used) = 117 chars (bytes).
- For a 2048 bit key length => max number of chars (bytes) to encrypt = 2048/8 - 11(when padding used) = 245 chars (bytes).
... and so on
By the way, if openssl_private_encrypt fails because of data size you won't get anything but just false as returned value, the same for openssl_public_decrypt() on decryption.
"- the encrypted output string is always 129 char length. If you use base64_encode on the encrypted output, it will give always 172 chars, with the last always "=" (filler)"
This again depends on the length of $key:
- For a 1024 bit key length => encrypted number of raw bytes is always a block of 128 bytes (1024 bits) by RSA design.
- For a 2048 bit key length => encrypted number of raw bytes is always a block of 256 bytes (2048 bits) by RSA design.
... and so on
About base64_encode output length, it depends on what you encode (meaning it depends on the bytes resulting after encryption), but in general the resulting encoded string will be about a 33% bigger (for 128 bytes bout 170 bytes and for 256 bytes about 340 bytes).
I would then generalize a little [P.Peyremorte]'s note by:
<?php
// given the variables as constants:
//Block size for encryption block cipher
private $ENCRYPT_BLOCK_SIZE = 200;// this for 2048 bit key for example, leaving some room
//Block size for decryption block cipher
private $DECRYPT_BLOCK_SIZE = 256;// this again for 2048 bit key
//For encryption we would use:
function encrypt_RSA($plainData, $privatePEMKey)
{
$encrypted = '';
$plainData = str_split($plainData, $this->ENCRYPT_BLOCK_SIZE);
foreach($plainData as $chunk)
{
$partialEncrypted = '';
//using for example OPENSSL_PKCS1_PADDING as padding
$encryptionOk = openssl_private_encrypt($chunk, $partialEncrypted, $privatePEMKey, OPENSSL_PKCS1_PADDING);
if($encryptionOk === false){return false;}//also you can return and error. If too big this will be false
$encrypted .= $partialEncrypted;
}
return base64_encode($encrypted);//encoding the whole binary String as MIME base 64
}
//For decryption we would use:
protected function decrypt_RSA($publicPEMKey, $data)
{
$decrypted = '';
//decode must be done before spliting for getting the binary String
$data = str_split(base64_decode($data), $this->DECRYPT_BLOCK_SIZE);
foreach($data as $chunk)
{
$partial = '';
//be sure to match padding
$decryptionOK = openssl_public_decrypt($chunk, $partial, $publicPEMKey, OPENSSL_PKCS1_PADDING);
if($decryptionOK === false){return false;}//here also processed errors in decryption. If too big this will be false
$decrypted .= $partial;
}
return $decrypted;
}
?>