Questions about Laravel encryption - php

Question

I have some questions about the Encrypt class from Laravel. I am hoping somebody could answer them.
It's mostly about the encrypt method on line 70 here:
https://github.com/illuminate/encryption/blob/master/Encrypter.php#L70
public function encrypt($value)
{
$iv = random_bytes(16);
$value = \openssl_encrypt(
serialize($value), $this->cipher, $this->key, 0, $iv
);
if ($value === false) {
throw new EncryptException('Could not encrypt the data.');
}
$mac = $this->hash($iv = base64_encode($iv), $value);
$json = json_encode(compact('iv', 'value', 'mac'));
if (! is_string($json)) {
throw new EncryptException('Could not encrypt the data.');
}
return base64_encode($json);
}
I have learned about openssl_encrypt and it seems like a good fit for a personal use case. I have made encrypt and decrypt methods using it.
The Laravel does a whole lot more than simply encrypting though.
Why does laravel serialize the value on encryption? If it's always a string that this method takes what is the advantages of serializing the data?
Why is base64_encode being used here?
Why are the values json_encoded? Is this used to keep a clean array or for other intents as well? Currently in my class's encrypt() method I simply concat the encrypted $value and $iv(Initialization vector). On decrypt I break them apart again.
Won't the openssl_encrypt throw already throw an exception when it can not encrypt data? Why is the return value checked if this is the case?
If somebody could take a minute to take a look at the github repo on the specified line I would be really happy.
Cheers!

Answer 1

Why does laravel serialize the value on encryption? If it's always a string that this method takes what is the advantages of serializing the data?
The function doesn't take just a string. It takes any (serializable) data type. It serializes the input value to convert it to a string; one that can be returned back to its original type upon decryption. I know the PhpDoc above the function states that the parameter is a string, but that seems like it is wrong and needs to be changed to mixed.
Why is base64_encode being used here?
base64 encoding is used on the $iv to convert the random bytes to a usable string by the hash method.
As far as base64 encoding the return value, I do not know. It seems as if they could have left it as the json encoded string, but maybe they wanted to make sure that the returned string did not have any special characters, or maybe they wanted one more piece of obfuscation.
Why are the values json_encoded? Is this used to keep a clean array or for other intents as well? Currently in my class's encrypt() method I simply concat the encrypted $value and $iv(Initialization vector). On decrypt I break them apart again.
Yes, the json_encoding is just to help facilitate a clean and easily parsible payload. They have three values they need to keep track of, and the easiest and cleanest way to be able to keep the values separated is with an array.
Won't the openssl_encrypt throw already throw an exception when it can not encrypt data? Why is the return value checked if this is the case?
I don't see any indications in the PHP documentation that openssl_encrypt will throw an exception. It does state, however, that it returns false on failure, which is the reason for the strict check on false.
Now, there are two reasons why it may emit a PHP Warning, which Laravel converts to an exception, but those aren't the only two ways that encryption may fail.