1

This question already has an answer here:

My shop was moved to a server without mcrypt and for some reason mcrypt can not be installed (don't ask me why!).

Looks like passwords are only encrypted with md5 with a salt (bad!) so I wonder what mcrypt is used for at all. Someone hacked Magento and was able to install it without mcrypt. Does not sound good to me but it was working for him.

Now i would like to know what for encrypt is used and will the show break if I replace it with a dummy? Is there a better workaround? May get secure random from openssl and add an encryption lib?

TL;DR

  • What is mcrypt used for in Magento?
  • Is a good workaround possible?

marked as duplicate by MagenX, 7ochem, Qaisar Satti, Klettseb, Amit Bera Feb 4 '16 at 17:38

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • I was not asking if it's needed. I know it is. Question is what it's needed for and if a good workaround is possible. – PiTheNumber Feb 4 '16 at 15:59
  • what you mean workaround? there is no workarounds for minimum requirements to run the application... lol – MagenX Feb 4 '16 at 16:00
  • this question is the same as: my hosting without pdo, innodb, ... etc – MagenX Feb 4 '16 at 16:05
  • @MagenX Well, mcrypt is not used for password, so the question is what is it used for and do I need that feature? Also there are other crypt libs that provide the used functions just a bit slower. In theory you can replace mcrypt. – PiTheNumber Feb 4 '16 at 16:08
3

MCrypt is not used for password and URL key hashing but for encrypting and decrypting sensitive data such as API passwords, e.g. stored in / retrieved from the system configuration.

All MCrypt functionality is encapsulated in Varien_Crypt_Mcrypt. This class again is accessed via Mage_Core_Model_Encryption. The encryption model that should be used throughout the application is configured in the config/global/helpers/core/encryption_model node.

So (in theory) there is sort of a chance to replace this one by your own encryption model – as long as it satisfies the former's interface. At first glance it looks like you need to extend Mage_Core_Model_Encryption and replace the _getCrypt method. This should return a class instance that implements the same methods as Varien_Crypt_Mcrypt – but makes use of a different encryption library.

1

You could patch the Magento code (for example via the app/local codepool) and replace the mcrypt functionality by those from PHPSecLib which offer an implementation of the functionality in pure PHP http://phpseclib.sourceforge.net/

Not the answer you're looking for? Browse other questions tagged or ask your own question.