Develop

Improvements of Security, Efficiency, Usability, and Compatibility for CI's Session Handler.

    
    Vulnerablities patched with this merge:
    CWE - 649 : Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking
     -  AES-CBC  wiouth an message authentication code.   This design allows for  an attacker construction various cryptography oracle  including  a Decryption Oracle and a Padding Oracle
     Cipher text is now  protected with a SHA1 HMAC

    CWE-329: Not Using a Random IV with CBC Mode
     - Block Cipher implamentation used a NULL iv
      ecrypt() generates a random iv for each message
    
    CWE-327: Use of a Broken or Risky Cryptographic Algorithm
     - Use of MD5 for integraty checking allowing Hash Length Extension Attacks.  
     Replaced with a proper sha1 hmac. 
    
     CWE-291: Trusting Self-reported IP Address
     - The ip_address() method can a return user supplied value.  
      Only one variable can be trusted $_SERVER['REMOTE_ADDR']

    

    List of Changes by file:
    config.php - was changed for efficiency and security.  Good security options are selected,  and bandwidth consuption has be
    
    AES.php - used as a backup if we cannot find an AES library.
  
    Crypto.php - Renamed from "Encrypt.php",  this now contains useful cryptographic tools such as a solid block cipher,  PRNG, and HMAC.
    
    Rijndael.php - used by AES.php
    
    Session_cookie.php - Modified for the new crypto changes.  Produces a more compact, and more random session id.  Helpful er