OCRA::generateOCRA()

Complexity

Conditions	44
Paths	> 20000

Size

Total Lines	197
Code Lines	104

Duplication

Lines	0
Ratio	0 %

Code Coverage

Tests	88
CRAP Score	49.9757

Importance

Changes	5
Bugs	0	Features	0

<?php 
    static function generateOCRA(string $ocraSuite,

It is generally recommended to explicitly declare the visibility for methods.

                                 string $key,
                                 string $counter,
                                 string $question,
                                 string $password,
                                 string $sessionInformation,
                                 string $timeStamp) : string
    {
        $codeDigits = 0;

The assignment to $codeDigits is dead and can be removed.

        $crypto = "";
        $result = null;
        $ocraSuiteLength = strlen($ocraSuite);
        $counterLength = 0;
        $questionLength = 0;
        $passwordLength = 0;

        $sessionInformationLength = 0;
        $timeStampLength = 0;

        // Parse the cryptofunction
        // The cryptofucntion is defined as HOTP-<hash function>-<t>, where
        // <hash function> is one of sha1, sha256 or sha512
        // <t> is the truncation length: 0 (no truncation), 4-10
        $components = explode(":", $ocraSuite);
        $cryptoFunction = $components[1];
        $dataInput = strtolower($components[2]); // lower here so we can do case insensitive comparisons

        if(stripos($cryptoFunction, "hotp-sha1")!==false)
            $crypto = "sha1";
        elseif(stripos($cryptoFunction, "hotp-sha256")!==false)
            $crypto = "sha256";
        elseif(stripos($cryptoFunction, "hotp-sha512")!==false)
            $crypto = "sha512";
        else {
            throw new InvalidArgumentException('Unsupported OCRA CryptoFunction');
        }

        // The Cryptofucntion must ha a truncation of 0, 4-10
        $codeDigits_str = substr($cryptoFunction, strrpos($cryptoFunction, "-")+1);
        if (! ctype_digit($codeDigits_str)) {
            throw new InvalidArgumentException('Unsupported OCRA CryptoFunction');
        }
        $codeDigits = (integer)$codeDigits_str;
        if (($codeDigits != 0) && (($codeDigits < 4) || ($codeDigits > 10))) {
            throw new InvalidArgumentException('Unsupported OCRA CryptoFunction');
        }
                
        // The size of the byte array message to be encrypted
        // Counter
        if($dataInput[0] == "c" ) {
            // Fix the length of the HEX string
            while(strlen($counter) < 16)
                $counter = "0" . $counter;
            $counterLength=8;
        }
        // Question
        if($dataInput[0] == "q" ||
                stripos($dataInput, "-q")!==false) {
            while(strlen($question) < 256)
                $question = $question . "0";
            $questionLength=128;
        }

        // Password
        if(stripos($dataInput, "psha1")!==false) {
            while(strlen($password) < 40)
                $password = "0" . $password;
            $passwordLength=20;
        }
    
        if(stripos($dataInput, "psha256")!==false) {
            while(strlen($password) < 64)
                $password = "0" . $password;
            $passwordLength=32;
        }
        
        if(stripos($dataInput, "psha512")!==false) {
            while(strlen($password) < 128)
                $password = "0" . $password;
            $passwordLength=64;
        }
        
        // sessionInformation
        if(stripos($dataInput, "s064") !==false) {
            while(strlen($sessionInformation) < 128)
                $sessionInformation = "0" . $sessionInformation;

            $sessionInformationLength=64;
        } else if(stripos($dataInput, "s128") !==false) {
            while(strlen($sessionInformation) < 256)
                $sessionInformation = "0" . $sessionInformation;
        
            $sessionInformationLength=128;
        } else if(stripos($dataInput, "s256") !==false) {
            while(strlen($sessionInformation) < 512)
                $sessionInformation = "0" . $sessionInformation;
        
            $sessionInformationLength=256;
        } else if(stripos($dataInput, "s512") !==false) {
            while(strlen($sessionInformation) < 128)
                $sessionInformation = "0" . $sessionInformation;
        
            $sessionInformationLength=64;
        } else if (stripos($dataInput, "-s") !== false ) {
            // deviation from spec. Officially 's' without a length indicator is not in the reference implementation.
            // RFC is ambigious. However we have supported this in Tiqr since day 1, so we continue to support it.

            // See the format of the datainput below. "[]" denotes optional.
            // Because Q is mandatory, s will always be preceded by the separator "-". Matching "-s" is required
            // to prevent matching the "s" in the password input e.g. "psha1".
            // [C] | QFxx | [PH | Snnn | TG] : Challenge-Response computation
            // [C] | QFxx | [PH | TG] : Plain Signature computation
            while(strlen($sessionInformation) < 128)
                $sessionInformation = "0" . $sessionInformation;
            
            $sessionInformationLength=64;
        }
        
        
             
        // TimeStamp
        if($dataInput[0] == "t" ||
                stripos($dataInput, "-t") !== false) {
            while(strlen($timeStamp) < 16)
                $timeStamp = "0" . $timeStamp;
            $timeStampLength=8;
        }

        // Put the bytes of "ocraSuite" parameters into the message
        
        $msg = array_fill(0,$ocraSuiteLength+$counterLength+$questionLength+$passwordLength+$sessionInformationLength+$timeStampLength+1, 0);
                
        for($i=0;$i<strlen($ocraSuite);$i++) {
            $msg[$i] = $ocraSuite[$i];
        }
        
        // Delimiter
        $msg[strlen($ocraSuite)] = "\0";

        // Put the bytes of "Counter" to the message
        // Input is HEX encoded
        if($counterLength > 0 ) {
            $bArray = self::_hexStr2Bytes($counter, $counterLength, 'counter');
            for ($i=0;$i<strlen($bArray);$i++) {
                $msg [$i + $ocraSuiteLength + 1] = $bArray[$i];
            }
        }


        // Put the bytes of "question" to the message
        // Input is text encoded
        if($questionLength > 0 ) {
            $bArray = self::_hexStr2Bytes($question, $questionLength, 'question');
            for ($i=0;$i<strlen($bArray);$i++) {
                $msg [$i + $ocraSuiteLength + 1 + $counterLength] = $bArray[$i];
            }
        }

        // Put the bytes of "password" to the message
        // Input is HEX encoded
        if($passwordLength > 0){
            $bArray = self::_hexStr2Bytes($password, $passwordLength, 'password');
            for ($i=0;$i<strlen($bArray);$i++) {
                $msg [$i + $ocraSuiteLength + 1 + $counterLength + $questionLength] = $bArray[$i];
            }
        }

        // Put the bytes of "sessionInformation" to the message
        // Input is HEX encoded
        if($sessionInformationLength > 0 ){
            $bArray = self::_hexStr2Bytes($sessionInformation, $sessionInformationLength, 'sessionInformation');
            for ($i=0;$i<strlen($bArray);$i++) {
                $msg [$i + $ocraSuiteLength + 1 + $counterLength + $questionLength + $passwordLength] = $bArray[$i];
            }
        }

        // Put the bytes of "time" to the message
        // Input is HEX encoded value of minutes
        if($timeStampLength > 0){
            $bArray = self::_hexStr2Bytes($timeStamp, $timeStampLength, 'timeStamp');
            for ($i=0;$i<strlen($bArray);$i++) {
                $msg [$i + $ocraSuiteLength + 1 + $counterLength + $questionLength + $passwordLength + $sessionInformationLength] = $bArray[$i];
            }
        }
        
        $byteKey = self::_hexStr2Bytes($key, strlen($key)/2, 'key');
              
        $msg = implode("", $msg);

        $hash = self::_hmac($crypto, $byteKey, $msg);

        if ($codeDigits == 0)
            $result = $hash;
        else
            $result = self::_oath_truncate($hash, $codeDigits);
             
        return $result;
    }