Doctrine encrypt column

Question

Using Doctrine 2 and Symfony 3, is there an easy way to automatically encrypt a column?

Ideally, it should work like this:

/**
 * @ORM\Column(name="secret", type="string")
 * @Encrypted
 */
private $secret;

Or, is there an official (or very popular) bundle that supports encryption and?

Answer 1

Not sure if there's any truth to it, I'm no crypto expert, but this repo's author (Michael de Groot) claims the "ambta" version is not secure and offers his own as a replacement.

This is an fork from the original bundle created by ambta which can be found here: ambta/DoctrineEncryptBundle

This bundle has updated security by not rolling it's own encryption and using verified standardized library's from the field.

ambta/DoctrineEncryptBundle is not secured, It uses old crypto functions and programming mistakes like supplying a IV in ECB mode (which does nothing)

Thought I'd leave that here in case there's truth to it as I'm currently looking around for the same functionality.

---

UPDATE 3

(2018-12-16)

Been working on our own Encrypt module the past few days. So if you've come here with hopes for a Zend Framework 3 + Doctrine module, have a look at mine.

The standard PHP 7.2 Sodium library and Paragonie's halite module's are used to handle the actual en-/decryption.

Encryption en hashing of properties is done in the Doctrine Events onFlush for storing (encryption & hashing) and postLoad for decryption.

Encryption and hashing of properties are enabled with @Encrypted and @Hashed Annotation respectively.

Additional:

• Encryption & Decryption Adapter, Subscriber & Service (for non-Event usage) are provided, using aliases, so you may override these to provide your own
• Supply just @Encrypted or @Hashed to enable usage.
• @Encrypted takes a type option to attempt to return that type upon decryption (postLoad)

---

Note: Updated the above (2018-12-16) to remove link to the one we created at work and encryption/hashing of data is important. Changed the link to my own repo as I'm leaving the company soon and, in agreement, I'll be taking over that repo, though I've also updated it with the additional Services. The company one (see answer history) is being deprecated in favor of mine.