PHP-GPG

REQUIREMENTS:

• Linux webserver
• PHP 4.x or greater
• Basic knowledge of PHP and PGP or GnuPG (GPG)

There are currently two flavors of two PHP/GPG scripts that are available. One set uses the PHP popen() function (which creates a temporary data file on the hard drive), and one set that uses proc_open() (which does not create any temporary data files*). I offer them all up for your perusal and use! PHP Classes were written using PEAR (http://pear.php.net/) standards…or as close as I could manage *heh*

Some key features of my script include:

• simple error reporting, for if (when) something fails
• handles encrypting data to as many PGP/GPG keys as you want or need
• handles both PGP/GPG key ID’s as well as specifying PGP/GPG keys by email address
• validation of submitted PGP/GPG keys, to make sure that they’re on the GPG keyring
• if a bad PGP/GPG key is submitted, it does not cause the failure of the script (unless there are no valid keys sent to the script)

Why two versions?

1. proc_open() vs. popen() :: The strength of the proc_open() approach is that it never writes the data to disk at any time – however, it does result in an error logfile being created on the hard drive, regardless of whether any errors are output or not. The popen() method, on the other hand, does output the the encrypted data directly to a temporary file, but does not create or require an error logfile to be created. The proc_open() method is slightly faster, but either method will work just fine.
2. PHP class vs function :: The PHP classes are object-oriented, for those who wish to take advantage of such things. However, for those that do not wish to get that involved or advanced, the simple/includeable functions will work just as well 🙂

If you need help with creating or managing a GPG keyring on your webserver, be sure to check out my PGKAdmin tool.

USE THESE SCRIPTS AT YOUR OWN RISK! I make no promises about the security of this script, nor do I guarantee it will work on any platform (or with any given version of GPG). While I have tried to ensure reasonable precautions to make these scripts as stable and secure as I can – you have been warned!

These scripts are open-source and free (no cost). You may do with it what you wish, as long as you leave the copyright data at the top in place.