Consider removing JCryptCipherSimple

[paragonie-scott]

joomla-cms/libraries/joomla/crypt/cipher/simple.php

Lines 61 to 100 in ec8a72f

	/**
	* Method to encrypt a data string.
	*
	* @param string $data The data string to encrypt.
	* @param JCryptKey $key The key[/pair] object to use for encryption.
	*
	* @return string The encrypted data string.
	*
	* @since 12.1
	* @throws InvalidArgumentException
	*/
	public function encrypt($data, JCryptKey $key)
	{
	// Validate key.
	if ($key->type != 'simple')
	{
	throw new InvalidArgumentException('Invalid key of type: ' . $key->type . '. Expected simple.');
	}
	$encrypted = '';
	$tmp = $key->private;
	// Split up the input into a character array and get the number of characters.
	$chars = preg_split('//', $data, -1, PREG_SPLIT_NO_EMPTY);
	$charCount = count($chars);
	// Repeat the key as many times as necessary to ensure that the key is at least as long as the input.
	for ($i = 0; $i < $charCount; $i = strlen($tmp))
	{
	$tmp = $tmp . $tmp;
	}
	// Get the XOR values between the ASCII values of the input and key characters for all input offsets.
	for ($i = 0; $i < $charCount; $i++)
	{
	$encrypted .= $this->_intToHex(ord($tmp[$i]) ^ ord($chars[$i]));
	}
	return $encrypted;
	}

XORing the plaintext with str_repeat($secretkey) is worse than encrypting in ECB mode.

There is no salvaging this "encryption" code. rm it, it's not secure.

[Bakual]

JCryptCipherSimple is already deprecated and will be removed with 4.0.
Due to B/C it is still shiped but it's recommended to use one of the more secure alternatives.

[paragonie-scott]

That's good, but I would seriously consider throwing an E_NOTICE or E_WARNING whenever it's used as of 3.5.0.

[wilsonge]

We aren't going to place potentially publicly visible notices on people's sites. The deprecation is the best we can do until Joomla 4 (potentially we can shove something in the log files but the reality is that very very few people ever check that file). There are no active use cases of this class in core. So I think we're pretty much doing the best we can at this stage. Our Joomla 4 deprecations branch already has this class (and all use cases removed as well https://github.com/joomla-projects/joomla-pythagoras/tree/feature/deprecations)