International PHP Conference Berlin 2025

    openssl_public_decrypt

    (PHP 4 >= 4.0.6, PHP 5, PHP 7, PHP 8)

    openssl_public_decrypt — Déchiffre des données avec une clé publique

    Description

    openssl_public_decrypt(
        string $data,
        #[\SensitiveParameter] string &$decrypted_data,
        OpenSSLAsymmetricKey|OpenSSLCertificate|array|string $public_key,
        int $padding = OPENSSL_PKCS1_PADDING
    ): bool

    openssl_public_decrypt() déchiffre les données data qui ont été chiffrées avec la fonction openssl_private_encrypt() et stocke le résultat dans decrypted_data.

    Vous pouvez utiliser cette fonction pour vérifier si le message a été écrit par le propriétaire de la clé privée.

    Liste de paramètres

    data

    decrypted_data

    public_key

    public_key doit être la clé publique qui a été utilisée pour chiffrer les données.

    padding

    padding peut être OPENSSL_PKCS1_PADDING ou OPENSSL_NO_PADDING.

    Valeurs de retour

    Cette fonction retourne true en cas de succès ou false si une erreur survient.

    Historique

    Version Description
    8.0.0 public_key accepte désormais une instance de OpenSSLAsymmetricKey ou OpenSSLCertificate ; auparavant, une resource de type OpenSSL key ou OpenSSL X.509 était acceptée.

    Voir aussi

    Found A Problem?

    Learn How To Improve This Page • Submit a Pull Request • Report a Bug
    ＋add a note

    User Contributed Notes 1 note

    up
    5
    Hernanibus
    8 years ago
    Just a little note on [P.Peyremorte]'s note in manual's openssl_private_encrypt.

    "- openssl_private_encrypt can encrypt a maximum of 117 chars at one time."

    This depends on the length of $key:

    - For a 1024 bit key length => max number of chars (bytes) to encrypt = 1024/8 - 11(when padding used) = 117 chars (bytes).
    - For a 2048 bit key length => max number of chars (bytes) to encrypt = 2048/8 - 11(when padding used) = 245 chars (bytes).
    ... and so on

    By the way, if openssl_private_encrypt fails because of data size you won't get anything but just false as returned value, the same for openssl_public_decrypt() on decryption.

    "- the encrypted output string is always 129 char length. If you use base64_encode on the encrypted output, it will give always 172 chars, with the last always "=" (filler)"

    This again depends on the length of $key:

    - For a 1024 bit key length => encrypted number of raw bytes is always a block of 128 bytes (1024 bits) by RSA design.
    - For a 2048 bit key length => encrypted number of raw bytes is always a block of 256 bytes (2048 bits) by RSA design.
    ... and so on

    About base64_encode output length, it depends on what you encode (meaning it depends on the bytes resulting after encryption), but in general the resulting encoded string will be about a 33% bigger (for 128 bytes bout 170 bytes and for 256 bytes about 340 bytes).

    I would then generalize a little [P.Peyremorte]'s note by:
    <?php
    // given the variables as constants:

    //Block size for encryption block cipher
    private $ENCRYPT_BLOCK_SIZE = 200;// this for 2048 bit key for example, leaving some room

    //Block size for decryption block cipher
    private $DECRYPT_BLOCK_SIZE = 256;// this again for 2048 bit key

    //For encryption we would use:
    function encrypt_RSA($plainData, $privatePEMKey)
    {
    $encrypted = '';
    $plainData = str_split($plainData, $this->ENCRYPT_BLOCK_SIZE);
    foreach(    $plainData as $chunk)
    {
    $partialEncrypted = '';

    //using for example OPENSSL_PKCS1_PADDING as padding
    $encryptionOk = openssl_private_encrypt($chunk, $partialEncrypted, $privatePEMKey, OPENSSL_PKCS1_PADDING);

    if(    $encryptionOk === false){return false;}//also you can return and error. If too big this will be false
    $encrypted .= $partialEncrypted;
    }
    return     base64_encode($encrypted);//encoding the whole binary String as MIME base 64
    }

    //For decryption we would use:
    protected function decrypt_RSA($publicPEMKey, $data)
    {
    $decrypted = '';

    //decode must be done before spliting for getting the binary String
    $data = str_split(base64_decode($data), $this->DECRYPT_BLOCK_SIZE);

    foreach(    $data as $chunk)
    {
    $partial = '';

    //be sure to match padding
    $decryptionOK = openssl_public_decrypt($chunk, $partial, $publicPEMKey, OPENSSL_PKCS1_PADDING);

    if(    $decryptionOK === false){return false;}//here also processed errors in decryption. If too big this will be false
    $decrypted .= $partial;
    }
    return     $decrypted;
    }
    ?>
    ＋add a note
    To Top