Real AES

Overview

Real AES provides an encryption method plugin for the Encrypt module. This plugin offers AES encryption using CBC mode and HMAC authentication through the Defuse PHP-Encryption library.

Requirements

• PHP 5.4 or later, with the OpenSSL extension
• Defuse PHP-Encryption library
  • Drupal 8: 2.x version of the library, as defined in this module's composer.json file
  • Drupal 7: A specific version of the library

Installation

Drupal 8

Install the Drupal 8 version of Real AES using Composer, after ensuring that your composer.json file includes packages.drupal.org/8 as a repository:

composer require drupal/real_aes

Drupal 7

Download the Real AES module and place it the usual location for contributed modules in your project. Download a specific version of the Defuse PHP-Encryption library, unzip the archive, name the resulting directory "php-encryption", and place it in your Libraries folder (sites/all/libraries).

Configuration

Drupal 8

Configure your site for encryption in Drupal 8 as follows:

1. Enable Real AES, Encrypt, and Key
2. Create a key using the Key module (at
   /admin/config/system/keys/add)
   • Select "Encryption" for the key type
   • Select "256" for the key size
   • Select your preferred key provider and enter provider-specific settings
     • The Configuration provider is fine for use during development, but should not be used on a production website
     • The File provider is more secure, especially if the file is stored outside of the web root directory
     • An even more secure option would be to use an off-site key management service, such as Lockr or Townsend Security's Alliance Key Manager
   • Click "Save"
3. Create an encryption profile using the Encrypt module (at
   /admin/config/system/encryption/profiles/add)
   • Select "Authenticated AES (Real AES)" for the encryption method
   • Select the name of the key definition you created in step 2
   • Click "Save"
4. Test your encryption by selecting "Test" under "Operations" for the
   encryption profile on the profiles listing page
   (/admin/config/system/encryption/profiles)

Drupal 7

Configure your site for encryption in Drupal 7 as follows:

1. Enable Real AES and Encrypt
2. Create an encryption configuration using the Encrypt module (at
   /admin/config/system/encrypt/add)
   • Select "Authenticated AES (Real AES)" for the encryption method
   • Select your preferred key provider and enter provider-specific settings (your key should be 128 bits in length)
     • The Configuration provider is fine for use during development, but should not be used on a production website
     • The File provider is more secure, especially if the file is stored outside of the web root directory
     • An even more secure option would be to use an off-site key management service, such as Lockr or Townsend Security's Alliance Key Manager
   • Click "Save configuration"

Usage in Drupal 7

• Use the Authenticated AES encryption method with the Encrypt module.
• If you implement encryption yourself, use this module as a library loader for Defuse PHP-Encryption. In your own code, include the library with libraries_load('php-encryption'), then call Crypto::encrypt, Crypto::decrypt and Crypto::createNewRandomKey directly.
• If necessary, enable the provided AES submodule. This is an API module exposing aes_encrypt and aes_decrypt for partial API compatibility with modules depending on the insecure AES module.

About Authenticated Encryption

Authenticated encryption ensures data integrity of the ciphertext. When decrypting, integrity is checked first. Further decryption operations will only be executed when the integrity check passes. This prevents certain ciphertext attacks on AES in CBC mode.

Credits

This module was created by LimoenGroen after carefully considering the various encryption modules and libraries available.

The port to Drupal 8 was performed by Sven Decabooter, supported by Acquia.

The library doing the actual work, Defuse PHP-Encryption, is maintained by Taylor Hornby and Scott Arciszewski.