对称加密 (AES) 与非对称加密 (RSA) 完整示例

<?php
// 对称加密：AES-256-GCM
$plaintext = "对称加密 - MZWU.COM";
$cipher = "aes-256-gcm";

// 256 位密钥，实际中要安全保存
$key = random_bytes(32);

// 初始化向量，类似随机盐，每次随机生成，GCM 推荐 12 字节 IV
$iv = random_bytes(12);
// 认证标签，验证密文有没有被篡改
$tag = '';

// 加密
$ciphertext = openssl_encrypt(
    $plaintext,
    $cipher,
    $key,
    OPENSSL_RAW_DATA,
    $iv,
    $tag
);

if ($ciphertext === false) {
    exit("加密失败: " . openssl_error_string() . PHP_EOL);
}

// 实际传输/存储时：iv + tag + 密文 一起保存
$payload = base64_encode($iv . $tag . $ciphertext);
echo "加密后: {$payload}\n";

// 解密
$raw = base64_decode($payload, true);
$iv2 = substr($raw, 0, 12);       // IV 12 字节
$tag2 = substr($raw, 12, 16);     // GCM tag 默认 16 字节
$ciphertext2 = substr($raw, 28);  // 剩下的密文

$decrypted = openssl_decrypt(
    $ciphertext2,
    $cipher,
    $key,
    OPENSSL_RAW_DATA,
    $iv2,
    $tag2
);

if ($decrypted === false) {
    exit("解密失败: " . openssl_error_string() . PHP_EOL);
}

echo "解密后: {$decrypted}\n";

openssl genpkey -algorithm RSA -out private.pem -pkeyopt rsa_keygen_bits:2048
openssl rsa -pubout -in private.pem -out public.pem

<?php
// 非对称加密：RSA-OAEP
$plaintext = "非对称加密 - MZWU.COM";

$privateKey = openssl_pkey_get_private(file_get_contents('private.pem'));
$publicKey  = openssl_pkey_get_public(file_get_contents('public.pem'));

if ($privateKey === false || $publicKey === false) {
    exit("密钥加载失败: " . openssl_error_string() . PHP_EOL);
}

// 公钥加密
if (!openssl_public_encrypt(
    $plaintext,
    $encrypted,
    $publicKey,
    OPENSSL_PKCS1_OAEP_PADDING
)) {
    exit("加密失败: " . openssl_error_string() . PHP_EOL);
}

$encryptedBase64 = base64_encode($encrypted);
echo "加密后: {$encryptedBase64}\n";

// 私钥解密
if (!openssl_private_decrypt(
    base64_decode($encryptedBase64, true),
    $decrypted,
    $privateKey,
    OPENSSL_PKCS1_OAEP_PADDING
)) {
    exit("解密失败: " . openssl_error_string() . PHP_EOL);
}

echo "解密后: {$decrypted}\n";