Description:
------------
As per PHP rfc https://wiki.php.net/rfc/mcrypt-viking-funeral mcrypt is being deprecated, being unmaintained since 2007 and probably containing quite a few bugs.

The RFC states:

> Everything libmcrypt can do, openssl can do too (and often better), either out-of-the-box or via its support for pluggable ciphers.

This is however not true. I am writing this because we currently use mcrypt here for a few things and OpenSSL does not work as an alternative to mcrypt.

More specifically low level control on the encryption allows encryption/decryption of streams, either manually (via mcrypt_generic_init) or PHP streams (see http://php.net/manual/en/filters.encryption.php )

There is currently no suitable alternative in OpenSSL or any bundled extension for encryption of streams (over tcp or in order to process large volumes of data) and while it is likely possible to write a PHP native implementation of AES and others, it would lead to a large loss in terms of performances.


I have no objection to see mcrypt disappear in exchange for something else, however there is currently no alternative except using implementations such as phpseclib which have both native code and use tricks to have OpenSSL handle streams of data. Having a clean implementation with PHP filters (or without, that's fine too) would be useful.