What encryption algorithm is best for encrypting cookies?

by

No real reason not to go with AES with 256 bits. Make sure to use this in CBC mode, and PKCS#7 padding.
As you said, fast and secure.

I have read (not tested) that Blowfish may be marginally faster… However Blowfish has a major drawback of long setup time, which would make it bad for your situation. Also, AES is more “proven”.

This assumes that it really is necessary to symmetrically encrypt your cookie data. As others have noted, it really shouldnt be necessary, and there are only a few edge cases where there’s no other choice but to do so. Commonly, it would better suit you to change the design, and go back to either random session identifiers, or if necessary one-way hashes (using SHA-256).
In your case, besides the “regular” random session identifier, your issue is the “remember me” feature – this should also be implemented as either:

  • a long random number, stored in the database and mapped to a user account;
  • or a keyed hash (e.g. HMAC) containing e.g. the username, timestamp, mebbe a salt, AND a secret server key. This can of course all be verified server-side…

Seems like we’ve gotten a little off topic of your original, specific question – and changed the basis of your question by changing the design….
So as long as we’re doing that, I would also STRONGLY recommend AGAINST this feature of persistent “remember me”, for several reasons, the biggest among them:

  • Makes it much more likely that someone may steal that user’s remember key, allowing them to spoof the user’s identity (and then probably change his password);
  • CSRF – Cross Site Request Forgery. Your feature will effectively allow an anonymous attacker to cause unknowing users to submit “authenticated” requests to your application, even without being actually logged in.

More Related Contents:

  1. How Secure Is This Login System? (Using Cookies In PHP)
  2. How do you Encrypt and Decrypt a PHP String?
  3. Simplest two-way encryption using PHP
  4. “Keep Me Logged In” – the best approach
  5. How to encrypt/decrypt data in php?
  6. Two-way encryption: I need to store passwords that can be retrieved
  7. PHP login system: Remember Me (persistent cookie) [duplicate]
  8. Login without HTTPS, how to secure?
  9. PHP setcookie “SameSite=Strict”?
  10. How do you set up use HttpOnly cookies in PHP
  11. Is it secure to store a password in a session? [duplicate]
  12. Session timeouts in PHP: best practices
  13. Are PDO prepared statements sufficient to prevent SQL injection?
  14. Why would one omit the close tag?
  15. Reference: What is a perfect code sample using the MySQL extension? [closed]
  16. The ultimate clean/secure function
  17. Preventing Directory Traversal in PHP but allowing paths
  18. What is the best way to stop people hacking the PHP-based highscore table of a Flash game
  19. PHP AES encrypt / decrypt
  20. Which $_SERVER variables are safe?
  21. PHP – setcookie(); not working
  22. What do I need to store in the php session when user logged in?
  23. What is the difference between Sessions and Cookies in PHP?
  24. How can I decrypt a password hash in PHP?
  25. Fastest hash for non-cryptographic uses?
  26. Best way to avoid code injection in PHP
  27. Secure and Flexible Cross-Domain Sessions
  28. Can a client view server-side PHP source code?
  29. Best way to connect to MySQL with PHP securely [duplicate]
  30. When to use filter_input()

Leave a Comment