Question

The CodeIgniter 2.0.2 requires to set an encryption key in the config file i.e. $config['encryption_key'] , if you want to use Session class. Can it be any string? Any example of secure encryption_key?

Thanks.

Answer 1

The key should be as random as possible and it must not be a regular
text string, nor the output of a hashing function, etc.

To save your key to your application/config/config.php, open the file and set:

$config['encryption_key'] = 'yourKeyHere'

Random Key Generator

It’s important for you to know that the encoded messages the encryption function generates will be approximately 2.6 times longer than the original message. For example, if you encrypt the string “my super secret data”, which is 21 characters in length, you’ll end up with an encoded string that is roughly 55 characters (we say “roughly” because the encoded string length increments in 64 bit clusters, so it’s not exactly linear). Keep this information in mind when selecting your data storage mechanism. Cookies, for example, can only hold 4K of information.