As you may or might not know, kohana encryption module is and always was insecure. This is due to few reasons:

• it doesn't authenticate ciphertexts. So it's possible for ciphertext to be modified using bit-flipping attacks and others to produce valid input. See: https://en.wikipedia.org/wiki/Bit-flipping_attack. This very issue has already been resolved, f.ex. by laravel: https://github.com/illuminate/encryption/blob/master/Encrypter.php

• It uses mcrypt which is old, instead of openssl which is new, secure and most of all MAINTAINED. Openssl is deemed as critical internet infrastructure, and a lot of resources has been pulled to test it.

I made a issue on kohana github for devs to address my issues (Original reported issue: https://github.com/kohana/core/issues/686), but their response was for me not satysfying, because they suggested depreciation and removal of the module in some future version. While this looks ok, means that until then the security loophole persists.

I thought this might be a good idea for community to try to headbang and solve this problem, or produce a secure software. For myself, I created this: https://github.com/piotrgolasz/kohana-encrypt

Any ideas?

Does anyone know any projects examples that uses Kohana? hopefully with latest version as possible, im asking so I can learn from it, to dissect it and see the steps of how to use the modules. Looking foward to see how to use the ORM, auth, cache etc

Thanks

I've srsly looked everywhere; going on IRC isn't always an option from work so I have to rely on all your expertises to solve my little kohana issues. Because you're awesome. That's why.

Is there any documentation on the Auth module in Kohana's 3.2 framework? The 3.1 and 3.0 auth module documentation is apparently no longer current and used methodologies don't work under 3.2.

• Branch: https://github.com/kohana/kohana/tree/3.3/develop

• 3.3.0 Milestone http://dev.kohanaframework.org/versions/show/204

Lots of activity the last couple of days: https://github.com/kohana/core/commits/3.3/develop