Improve encryption strength

[john-shaffer]

The encryption uses AES256, but the implementation silently discards half of the available entropy. That is, we take a sha256 hash of $secret_key, which is 64 hex chars, but the implementation only uses the first 32 chars, which is 256 bits of memory but only 128 bits of entropy. I instead call hex2bin to decode the 64 hex chars into 32 bytes of memory. There is a similar issue with the initial variate which I also patched.

There is an explanation at https://stackoverflow.com/questions/55062897/decrypt-aes256-on-python-vs-php/55063033#55063033. The root problem here is that openssl_decrypt and openssl_encrypt silently truncate the key, discarding half of the entropy without warning.

[leonstafford]

Oh, brilliant! Security's not my strong point, but will try to grok it!

Aside, have started using https://github.com/phpseclib/phpseclib for upcoming sFTP add-on. Would that offer any advantage here?

[leonstafford]

Thanks again, @john-shaffer!

I cast the results of hex2bin to string to pass type-checking. Please let me know if there's any issues: b5c3202

[john-shaffer]

Thank you, @leonstafford. That works perfectly.