Broken Cipher (ARCH7112)

Key php.security.broken-cipher · Severity error · Category security · CWE CWE-327

Symmetric ciphers such as DES, 3DES, RC4 and Blowfish are cryptographically broken or obsolete. Using them for confidentiality means the data can be decrypted at a reasonable cost.

Incorrect

<?php
$cipher = openssl_encrypt($plaintext, 'DES-EDE3-CBC', $key, 0, $iv); // 3DES is broken

Correct

<?php
$iv = random_bytes(12);
$cipher = openssl_encrypt($plaintext, 'aes-256-gcm', $key, OPENSSL_RAW_DATA, $iv, $tag);

Fix

Use a modern, authenticated cipher; prefer AEAD modes such as AES-256-GCM.