Back to Details

php-crypto-audit

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

PHP 加密与密钥安全审计（php-crypto-audit）

PHP Encryption and Key Security Audit (php-crypto-audit)

分析 PHP 项目源码中密码/令牌/敏感数据的加密与哈希实现，检测：

弱哈希（MD5/SHA1/无 salt）
不安全的对称/非对称加密使用（ECB、固定 IV、错误模式）
签名校验缺陷（JWT 未验证、HMAC 用错、算法选择可控）
硬编码密钥/明文 key 泄露

Analyzes the encryption and hashing implementations of passwords/tokens/sensitive data in PHP project source code, and detects:

Weak hashes (MD5/SHA1/no salt)
Unsecure usage of symmetric/asymmetric encryption (ECB, fixed IV, incorrect mode)
Signature verification flaws (JWT unverified, wrong HMAC usage, controllable algorithm selection)
Hardcoded keys/plaintext key leakage

分级与编号

Severity Rating and Numbering

详见：
```
shared/SEVERITY_RATING.md
```
漏洞编号：
```
{C/H/M/L}-CRYPTO-{序号}
```

See details:
```
shared/SEVERITY_RATING.md
```
Vulnerability ID:
```
{C/H/M/L}-CRYPTO-{serial number}
```

必检 Sink（强制）

Mandatory Check Sinks

必须搜索并分析以下实现点（按项目实际替换）：

密码哈希：
```
md5/sha1/hash
```
（非 password_hash）、
```
crypt
```
参数误用
安全哈希：
```
password_hash
```
/
```
password_verify
```
（检查是否参数正确）
对称加密：
```
openssl_encrypt/decrypt
```
（检查 mode/iv）
签名：
```
hash_hmac
```
、
```
openssl_sign
```
、JWT verify/签名比较实现

Must search and analyze the following implementation points (replace according to actual project):

Password hashing:
```
md5/sha1/hash
```
(non password_hash), misused
```
crypt
```
parameters
Secure hashing:
```
password_hash
```
/
```
password_verify
```
(check if parameters are correct)
Symmetric encryption:
```
openssl_encrypt/decrypt
```
(check mode/iv)
Signatures:
```
hash_hmac
```
,
```
openssl_sign
```
, JWT verify/signature comparison implementation

必检要求（强制）

Mandatory Check Requirements

必须定位“密钥来源”：硬编码/环境变量/配置文件/请求参数
必须判断“校验是否可靠”：是否存在算法可控或比较时序泄露
必须输出修复建议与迁移方案（例如升级哈希算法、强制使用参数化模式）

Must locate the "key source": hardcoded/environment variable/configuration file/request parameter
Must judge whether "verification is reliable": whether there is controllable algorithm or timing leakage in comparison
Must output remediation recommendations and migration plans (e.g., upgrade hashing algorithm, enforce parameterized mode)

PoC（强制框架）

PoC (Mandatory Framework)

由于加密类漏洞可能依赖环境，PoC 至少要给出：

可执行的“验证框架”（例如构造 JWT payload 并解释应当发生的验证失败/绕过）
或给出可观测的证据（例如日志泄露、错误模式产生可逆结果）

Since encryption-related vulnerabilities may depend on the environment, the PoC must provide at least:

An executable "verification framework" (e.g., construct JWT payload and explain the expected verification failure/bypass)
Or observable evidence (e.g., log leakage, reversible results caused by incorrect mode)

报告输出

Report Output

{output_path}/vuln_audit/crypto_{timestamp}.md

{output_path}/vuln_audit/crypto_{timestamp}.md