1

My shop was moved to a server without mcrypt and for some reason mcrypt can not be installed (don't ask me why!).

Looks like passwords are only encrypted with md5 with a salt (bad!) so I wonder what mcrypt is used for at all. Someone hacked Magento and was able to install it without mcrypt. Does not sound good to me but it was working for him.

Now i would like to know what for encrypt is used and will the show break if I replace it with a dummy? Is there a better workaround? May get secure random from openssl and add an encryption lib?

TL;DR

  • What is mcrypt used for in Magento?
  • Is a good workaround possible?
Improve this question
4
  • I was not asking if it's needed. I know it is. Question is what it's needed for and if a good workaround is possible.
    – PiTheNumber
    Feb 4, 2016 at 15:59
  • what you mean workaround? there is no workarounds for minimum requirements to run the application... lol
    – MagenX
    Feb 4, 2016 at 16:00
  • this question is the same as: my hosting without pdo, innodb, ... etc
    – MagenX
    Feb 4, 2016 at 16:05
  • @MagenX Well, mcrypt is not used for password, so the question is what is it used for and do I need that feature? Also there are other crypt libs that provide the used functions just a bit slower. In theory you can replace mcrypt.
    – PiTheNumber
    Feb 4, 2016 at 16:08

2 Answers 2

Reset to default
3

MCrypt is not used for password and URL key hashing but for encrypting and decrypting sensitive data such as API passwords, e.g. stored in / retrieved from the system configuration.

All MCrypt functionality is encapsulated in Varien_Crypt_Mcrypt. This class again is accessed via Mage_Core_Model_Encryption. The encryption model that should be used throughout the application is configured in the config/global/helpers/core/encryption_model node.

So (in theory) there is sort of a chance to replace this one by your own encryption model – as long as it satisfies the former's interface. At first glance it looks like you need to extend Mage_Core_Model_Encryption and replace the _getCrypt method. This should return a class instance that implements the same methods as Varien_Crypt_Mcrypt – but makes use of a different encryption library.

Improve this answer
1

You could patch the Magento code (for example via the app/local codepool) and replace the mcrypt functionality by those from PHPSecLib which offer an implementation of the functionality in pure PHP http://phpseclib.sourceforge.net/

Improve this answer
1
  • How to install php_mcrypt in wamp? @Alex
    – Gem
    Sep 16, 2019 at 10:24

Not the answer you're looking for? Browse other questions tagged or ask your own question.