opencart-ce/opencart-ce — pull request #68 by sarciszewski (2014-07-01 17:44:19+00:00)
Title: Upgrade Encryption Class

Since `rph` from the OpenCart forums pointed me this way, I decided to make the CE version of the encryption library better than the opencart repository offers:

Changes made:
* Use the correct AES cipher
* Use CBC mode instead of ECB mode
* Authenticate ciphertexts (Encrypt then HMAC :: Verify then decrypt)
* Generate IVs with `MCRYPT_DEV_URANDOM` instead of the insecure `MCRYPT_RAND`

I would recommend having a cryptographer examine these changes before merging.

References:
https://github.com/opencart/opencart/pull/1594
http://forum.opencart.com/viewtopic.php?f=10&t=127530

I hereby license this commit as WTFPL, BSD, MIT, GPLv3, Apache, CC0, and any other applicable license anyone really cares about using. Go nuts.