Encryption inside ActiveManage is pluggable — you choose which underlying library handles the crypto operations. The choice mostly affects performance, supported algorithms, and which PHP extensions need to be available on the server.
Available Engines
- Sodium (recommended): Modern, fast, with sensible defaults. Bundled with PHP 7.2+. Supports XChaCha20-Poly1305, Curve25519, Ed25519.
- OpenSSL: Wider algorithm choice — AES-GCM in multiple key sizes, RSA, ECDSA across many curves. Useful when interoperating with non-PHP systems.
- mcrypt (legacy): Deprecated in PHP 7.2. Only enable for read-back compatibility with very old encrypted data; never use for new writes.
Choosing
- New deployment: Sodium. No exceptions.
- Need interoperability with Java/C# system using AES-GCM-256: OpenSSL.
- Migrating from a system that used mcrypt: Enable mcrypt-legacy for read access, write new records with Sodium, run a background task to re-encrypt old records.
Performance
Sodium is typically 1.5–3× faster than equivalent OpenSSL operations for small payloads (under 4KB). For bulk file encryption (multi-megabyte) OpenSSL's hardware AES support edges ahead on modern Intel/AMD CPUs.
Worked Examples
- Default greenfield app: Sodium throughout — encrypts session cookies, stored API tokens, sensitive datastore columns.
- FIPS-required environment: OpenSSL with the FIPS provider — required for some US government contracts.
- Migration project: Both engines enabled; legacy reads via mcrypt, all new writes via Sodium, weekly batch re-encrypts 100,000 rows.
Warning: mcrypt has known weaknesses and is unmaintained. Never expose it to user-controlled input — limit its use strictly to decrypting historical data.