Simple two-way encryption to generate encrypted key with no special character - encryption

Question

I have a simple two way encryption method which generates encrypted string. The method is given below:-
public function cryption($string, $action = 'e')
{
$secret_key = 'secret-key';
$secret_iv = 'secret_iv';
$output = false;
$encrypt_method = "AES-256-CBC";
$key = hash( 'sha256', $secret_key );
$iv = substr( hash( 'sha256', $secret_iv ), 0, 16 );
if( $action == 'e' ){
$output = openssl_encrypt( $string, $encrypt_method, $key, 0, $iv );
}else if( $action == 'd' ){
$output = openssl_decrypt( $string, $encrypt_method, $key, 0, $iv );
}
return $output;
}
The problem is, it creates a string like this-
yTJbtH7mIJjhY+SatnTxY5i2jt/qUW+nZgmGBeBgZEzpy2GMSBQgDjKeyjxGOdJd
Such encrypted keys have chars like / & +. I want a simple two way encryption which could generate string consisting of only alphanumeric characters.
Note: This string will be sent as parameter to a codeigniter controller method. Having slashes means the portion of the string after a slash will be treated as a separate parameter.

Answer 1

I am not a crypto expert, so I can't tell if there is an encryption or hashing method which produces only alphanumeric characters in its encrypted / hashed output.
However, I believe I can help you solve the underlying problem. This is one of the typical cases where escaping comes in handy. In the following, I will provide an over-simplified example which will show the concept.
So let us assume that the + character is the only forbidden character and that your cryptographic functions have output the string ab+cyk; this would be the value of $output in your code.
Now let us define the following replacement of character sequences:
+ <-> ya
i.e. you are doing a further processing of $output before sending it, where + gets replaced by ya. This way, you have eliminated all + characters from $output.
When the codeigniter controller receives that string, it first de-escapes (unescapes) it, applying the reverse process. In this case, it would replace all occurrences of ya by + to get the original encrypted string back, and can then (cryptographically) decrypt the result.
Now we are almost there, but we have one problem left. Currently the receiver (controller) can't distinguish if the character sequence ya in the received string actually indeed means ya or if it means +.
We can solve that problem if we define another replacement which must be applied by the sender and the receiver:
y <-> yy
Now, the character sequence ya, when encountered by the controller in the received string, would be unambiguous. It would mean + because the original sequence ya would have been escaped (encoded) as yya.
Coming back to our over-simplified example, the string ab+cyk would become abyacyyk at the sender's side and could be unambiguously decoded by the receiver (controller).
This principle (with variations) has been applied in countless standards and situations in software development. The most famous which immediately come to my mind are C (where the backslash has a special meaning in string constants, so the backslash is the escape character) and the escaping of URIs (where the percent sign is the escape character).
Of course, in our example, the y character is the escape character. Please note that we are not urged to double the escape character if we want to have it literally; this is just a random (though frequent) choice. In our example, we could have escaped y by yz or something else instead of yy.
Given your reputation, I am convinced that you are able to write an appropriate encoding and decoding function within minutes, and that you easily can extend the example to escape other unwanted characters as well (for example, escape / as yb). If you need help, please leave a comment, and I'll add appropriate pseudo-code to my answer.
But eventually, there already is a solution: If you can accept percent signs (%) in the string the sender sends to the receiver (controller), you can simply use URI escaping.
The key point here is that every (scripting) language I know of has modules or even core functions which do URI escaping and unescaping (also called URI encoding and decoding) reliably, comfortably and (last, but not least) efficiently. In most cases, you even can tell those modules / functions which characters you would like to have escaped and which not, in case you would like to deviate from the usual character sets.
The only disadvantage of this solution is that it may increase the size of the payload, and that you can't predict the size before actually having encoded the payload.
For example, if we would encode and decode as described above, the size of our string would be doubled upon encoding if it would contain only + and y characters. If we would apply URI encoding, the string size even could be tripled (because a character to be escaped would be replaced by a percent sign plus the hexadecimal code of the character, i.e. A would be replaced by %41, for example (if A would be in the character set to be replaced)).
Given today's bandwidth, storage and RAM speed and CPU power, I don't suppose that this becomes a real problem in your case.