[magnus]

There has to be a password. Whether the password is chosen by the user or randomly assigned, there's still one there. Sure, one could be randomly determined from the datestring, username, etc.. or any combination. By predetermining the string, it would then need to be stored within the DB -- thus, in my opinion, rendering encryption useless. The only true way to keep it secure is to have the parties involved share the password/key/hash amongst themselves in advance.

I assume the whole point of this is so that you, the Admin (or anyone with access to the MySQL DB), cannot read a member's PM's. Correct?

* Edit --

One way for this to happen is the sender chooses a string of characters to base the encryption off of, then that string (or decryption key) is sent to the recipient via e-mail. That way the key is not stored in the DB, and the only parties with access to it are the sender and recipient(s).

In retrospect, if there's no secure method of sharing the key externally -- encryption would be overkill and a simple PHP encode(); would basically yield the same result, as you can then decode(); the text with no need for a key.

Of course, one would then need to determine the actual usefulness of such a modification -- as I can't see people sharing things requiring that level of security over a public medium such as a vBulletin forum.