encrypt.php

#!/usr/bin/env php
<?php

// Constants
define('ENCRYPTION_ALGO', 'aes-256-cbc');
define('SALT_PREFIX', 'Salted__');
define('KEY_LENGTH', 32);
define('PBKDF2_ALGO', 'sha256');
define('PBKDF2_ROUNDS', 10000);
define('ENCRYPTED_CONTENT_ENCODING', 'base64');
define('UNENCRYPTED_CONTENT_ENCODING', 'utf8');

function showHelp() {
    echo "Usage: php encrypt.php [encrypt|decrypt] [options]\n";
    echo "\n";
    echo "Options:\n";
    echo "  --text=<text>           Input text\n";
    echo "  --file=<file>           Input file\n";
    echo "  --password=<pass>       Password for encryption/decryption. Optional.\n";
    echo "  --output=<file>         Output file (default: print to stdout)\n";
    echo "  --dec-encoding=<enc>    Encoding of the decrypted input/output (base64|utf8) (default: utf8)\n";
    echo "  --help                  Show this help message\n";
}

function parseArgs() {
    global $argv;
    $args = array_slice($argv, 1);
    
    if (empty($args) || in_array('--help', $args)) {
        showHelp();
        exit(1);
    }
    
    $action = $args[0];
    $options = [];
    
    for ($i = 1; $i < count($args); $i++) {
        $arg = $args[$i];
        if (strpos($arg, '--') === 0) {
            $parts = explode('=', $arg, 2);
            $key = substr($parts[0], 2);
            $value = isset($parts[1]) ? trim($parts[1]) : true;
            $options[$key] = $value;
        }
    }
    
    return [$action, $options];
}

function getInputContent($options) {
    if (isset($options['file'])) {
        if (!file_exists($options['file'])) {
            echo "Error: Input file does not exist: {$options['file']}\n";
            exit(1);
        }
        return file_get_contents($options['file']);
    }
    
    if (isset($options['text'])) {
        return $options['text'];
    }
    
    return readline("Enter content: ");
}

function getPassword($options) {
    if (isset($options['password'])) {
        return $options['password'];
    }
    
    // Use readline with hidden input simulation (not perfect but works)
    // For better security, consider using system('stty -echo') on Unix
    echo "Enter password: ";
    system('stty -echo');
    $password = trim(fgets(STDIN));
    system('stty echo');
    echo "\n";
    
    return $password;
}

function deriveKeyAndIV($password, $salt) {
    $derived = hash_pbkdf2(
        PBKDF2_ALGO,
        $password,
        $salt,
        PBKDF2_ROUNDS,
        KEY_LENGTH + 16,
        true // raw binary output
    );
    
    $key = substr($derived, 0, KEY_LENGTH);
    $iv = substr($derived, KEY_LENGTH, 16);
    
    return [$key, $iv];
}

function encrypt($content, $password) {
    // Generate salt
    $salt = random_bytes(8);
    
    // Derive key and IV from password and salt using PBKDF2
    [$key, $iv] = deriveKeyAndIV($password, $salt);
    
    // Encrypt using AES-256-CBC
    $encryptedContent = openssl_encrypt(
        $content,
        ENCRYPTION_ALGO,
        $key,
        OPENSSL_RAW_DATA,
        $iv
    );
    
    if ($encryptedContent === false) {
        echo "Error: Encryption failed\n";
        exit(1);
    }
    
    // Build final buffer: prefix + salt + encrypted content
    $finalBuffer = SALT_PREFIX . $salt . $encryptedContent;
    
    // Encode to base64
    return base64_encode($finalBuffer);
}

function decrypt($encrypted, $password) {
    // Decode from base64
    $buffer = base64_decode($encrypted, true);
    
    if ($buffer === false) {
        echo "Error: Invalid base64 input\n";
        exit(1);
    }
    
    // Extract salt (skip the prefix)
    $salt = substr($buffer, strlen(SALT_PREFIX), 8);
    $encryptedContent = substr($buffer, 16);
    
    // Derive key and IV from password and salt using PBKDF2
    [$key, $iv] = deriveKeyAndIV($password, $salt);
    
    // Decrypt using AES-256-CBC
    $decryptedContent = openssl_decrypt(
        $encryptedContent,
        ENCRYPTION_ALGO,
        $key,
        OPENSSL_RAW_DATA,
        $iv
    );
    
    if ($decryptedContent === false) {
        echo "Error: Decryption failed\n";
        exit(1);
    }
    
    return $decryptedContent;
}

function main() {
    [$action, $options] = parseArgs();
    
    if (!in_array($action, ['encrypt', 'decrypt'])) {
        showHelp();
        exit(1);
    }
    
    $content = getInputContent($options);
    $password = getPassword($options);
    
    if ($action === 'encrypt') {
        $output = encrypt($content, $password);
    } else {
        $output = decrypt($content, $password);
        
        // Handle dec-encoding option (though not used in decrypt function, keeping for compatibility)
        if (isset($options['dec-encoding']) && $options['dec-encoding'] === 'base64') {
            $output = base64_encode($output);
        }
    }
    
    if (isset($options['output'])) {
        file_put_contents($options['output'], $output);
    } else {
        echo $output . "\n";
    }
}

main();