laravel/framework — pull request #4030 by ezzatron (2014-04-03 00:39:09+00:00)
Title: Fix the encrypter to actually use AES encryption by default.

Fix for #4027.

The encrypter class was using incorrect values for implementing AES encryption. Instead of using Rijndael with a 128 bit block size (AES), the encrypter was using a 256 bit block size. This is a common mistake - confusing the block size with the key size. This PR changes the default operation of the encrypter to use the correct cipher for AES encryption.

Note that it is still possible to decrypt data encrypted before this PR, but you must manually set `MCRYPT_RIJNDAEL_256` as the cipher.

This PR also fixes a bug whereby changing the cipher/mode would not update the internal block size used to calculate the padding length.

Regarding whether this is "important" or not, a good summary of the difference between Rijndael in 128 and 256 bit block sizes can be found in this [StackExchange answer](http://crypto.stackexchange.com/questions/6016/difference-between-rijndael-128-256-blocksize-implementations-and-impact-of):

> ...
> This means that Rijndael-128-256 will be slower than Rijndael-128-128 (AES-128), and that Rijndael-256-256 *may* have a lower security margin that Rijndael-256-128.
>
> **Bottom line**
>
> Rijndael N-256 hasn't received nearly as much attention as AES, so it might have some undiscovered weaknesses.
>
> In contrast, AES is considered secure, despite being subject to probably more cryptanalysis than any other cipher.
>
> The 128-bit block size isn't a problem. If it ain't broken, don't fix it!

I'll submit a related documentation PR shortly.