AlexLisenkov\LaravelWebPush\P256EncryptedMessage

Complexity

Total Complexity

18

Size/Duplication

Total Lines	227
Duplicated Lines	0 %

Test Coverage

Coverage

100%

Importance

Changes	1
Bugs	0	Features	0

17 Methods

Rating	Name	Duplication	Size	Complexity
A	getEncodedPrivateKey()	0	3	1
A	getPrivateKey()	0	3	1
A	getPseudoRandomKey()	0	5	1
A	getSubscriberPublicKey()	0	3	1
A	padPayload()	0	6	1
A	hkdf()	0	7	1
A	getSalt()	0	3	1
A	getSharedSecret()	0	5	1
A	getCypherLength()	0	3	1
A	getContext()	0	5	1
A	getEncodedPublicKey()	0	3	1
A	getEncodedSalt()	0	3	1
A	getContentEncryptionKey()	0	5	1
A	__construct()	0	12	1
A	getNonce()	0	5	1
A	getPublicKey()	0	3	1
A	getCypher()	0	18	2

<?php

namespace AlexLisenkov\LaravelWebPush;

use AlexLisenkov\LaravelWebPush\Contracts\P256EncryptedMessageContract;
use Base64Url\Base64Url;
use Elliptic\EC\KeyPair;

class P256EncryptedMessage implements P256EncryptedMessageContract
{
    /**
     * @var KeyPair
     */
    private $private;
    /**
     * @var KeyPair
     */
    private $subscriber;
    /**
     * @var string
     */
    private $salt;
    /**
     * @var string
     */
    private $auth_token;
    /**
     * @var string
     */
    private $payload;
    /**
     * @var string
     */
    private $cypher;

    /**
     * P256EncryptedMessage constructor.
     *
     * @param KeyPair $private
     * @param KeyPair $subscriber
     * @param string $auth_token Decoded version of auth token
     * @param string $salt 16 byte salt
     * @param string $payload
     */
    public function __construct(
        KeyPair $private,
        KeyPair $subscriber,
        string $auth_token,
        string $salt,
        string $payload
    ) {
        $this->private = $private;
        $this->subscriber = $subscriber;
        $this->salt = $salt;
        $this->auth_token = $auth_token;
        $this->payload = $payload;
    }

    /**
     * @return int
     */
    public function getCypherLength(): int
    {
        return mb_strlen($this->getCypher(), '8bit');
    }

    /**
     * @return string
     */
    public function getCypher(): string
    {
        if (!$this->cypher) {
            $payload = $this->padPayload($this->payload);

            $cypher = openssl_encrypt(
                $payload,
                'aes-128-gcm',
                $this->getContentEncryptionKey(),
                OPENSSL_RAW_DATA,
                $this->getNonce(),
                $tag
            );

            $this->cypher = $cypher . $tag;
        }

        return $this->cypher;
    }

    /**
     * @param $payload
     *
     * @return string
     */
    private function padPayload($payload): string
    {
        $payload_length = mb_strlen($payload, '8bit');
        $pad_length = Constants::PADDED_PAYLOAD_LENGTH - $payload_length;

        return pack('n*', $pad_length) . str_pad($payload, Constants::PADDED_PAYLOAD_LENGTH, "\x00", STR_PAD_LEFT);
    }

    /**
     * The content encryption key (CEK) is the key that will ultimately be used to encrypt our payload.
     *
     * @return string
     */
    public function getContentEncryptionKey(): string
    {
        $keyLabelInfo = "Content-Encoding: aesgcm\x00P-256" . $this->getContext();

        return $this->hkdf($this->salt, $this->getPseudoRandomKey(), $keyLabelInfo, 16);
    }

    /**
     * The "context" is a set of bytes that is used to calculate two values later on in the encryption browser.
     * It's essentially an array of bytes containing the subscription public key and the local public key.
     */
    public function getContext(): string
    {
        $len = "\x00A";

        return "\x00" . $len . $this->getSubscriberPublicKey() . $len . $this->getPublicKey();
    }

    /**
     * @return string
     */
    private function getSubscriberPublicKey(): string
    {
        return hex2bin($this->subscriber->getPublic('hex'));
    }

    /**
     * @return string
     */
    public function getPublicKey(): string
    {
        return hex2bin($this->private->getPublic('hex'));
    }

    /**
     * @param string $salt
     * @param string $ikm
     * @param string $info
     * @param int $length
     *
     * @return string
     */
    private function hkdf(string $salt, string $ikm, string $info, int $length): string
    {
        // extract
        $prk = hash_hmac('sha256', $ikm, $salt, true);

        // expand
        return mb_substr(hash_hmac('sha256', $info . chr(1), $prk, true), 0, $length, '8bit');
    }

    /**
     * The Pseudo Random Key (PRK) is the combination of the push subscription's auth secret,
     * and the shared secret.
     *
     * @return string
     */
    public function getPseudoRandomKey(): string
    {
        $info = "Content-Encoding: auth\x00";

        return $this->hkdf($this->auth_token, $this->getSharedSecret(), $info, 32);
    }

    /**
     * @return bool|string
     */
    public function getSharedSecret(): string
    {
        $shared_secret = $this->private->derive($this->subscriber->getPublic());

        return hex2bin(str_pad(gmp_strval($shared_secret->toString(), 16), 64, '0', STR_PAD_LEFT));
    }

    /**
     * A nonce is a value that prevents replay attacks as it should only be used once.
     *
     * @return string
     */
    public function getNonce(): string
    {
        $nonceEncInfo = "Content-Encoding: nonce\x00P-256" . $this->getContext();

        return $this->hkdf($this->salt, $this->getPseudoRandomKey(), $nonceEncInfo, 12);
    }

    /**
     * Get Salt
     *
     * @return string
     */
    public function getSalt(): string
    {
        return $this->salt;
    }

    /**
     * Get Salt
     *
     * @return string
     */
    public function getEncodedSalt(): string
    {
        return Base64Url::encode($this->salt);
    }

    /**
     * @return string
     */
    public function getPrivateKey(): string
    {
        return hex2bin($this->private->getPrivate('hex'));
    }

    /**
     * @return string
     */
    public function getEncodedPrivateKey(): string
    {
        return Base64Url::encode(hex2bin($this->private->getPrivate('hex')));
    }

    /**
     * @return string
     */
    public function getEncodedPublicKey(): string
    {
        return Base64Url::encode(hex2bin($this->private->getPublic('hex')));
    }
}