PHP Encryption and Key Security Audit (php-crypto-audit)

• Weak hashes (MD5/SHA1/no salt)
• Unsecure usage of symmetric/asymmetric encryption (ECB, fixed IV, incorrect mode)
• Signature verification flaws (JWT unverified, wrong HMAC usage, controllable algorithm selection)
• Hardcoded keys/plaintext key leakage

Severity Rating and Numbering

• See details:

  shared/SEVERITY_RATING.md

• Vulnerability ID:

  {C/H/M/L}-CRYPTO-{serial number}

Mandatory Check Sinks

• Password hashing:

  md5/sha1/hash

  (non password_hash), misused

  crypt

  parameters
• Secure hashing:

  password_hash

  /

  password_verify

  (check if parameters are correct)
• Symmetric encryption:

  openssl_encrypt/decrypt

  (check mode/iv)
• Signatures:

  hash_hmac

  ,

  openssl_sign

  , JWT verify/signature comparison implementation

Mandatory Check Requirements

• Must locate the "key source": hardcoded/environment variable/configuration file/request parameter
• Must judge whether "verification is reliable": whether there is controllable algorithm or timing leakage in comparison
• Must output remediation recommendations and migration plans (e.g., upgrade hashing algorithm, enforce parameterized mode)

PoC (Mandatory Framework)

• An executable "verification framework" (e.g., construct JWT payload and explain the expected verification failure/bypass)
• Or observable evidence (e.g., log leakage, reversible results caused by incorrect mode)

Report Output

{output_path}/vuln_audit/crypto_{timestamp}.md