| @@ 70-127 (lines=58) @@ | ||
| 67 | * @return string |
|
| 68 | * @throws Error |
|
| 69 | */ |
|
| 70 | public static function aead_chacha20poly1305_decrypt( |
|
| 71 | $message = '', |
|
| 72 | $ad = '', |
|
| 73 | $nonce = '', |
|
| 74 | $key = '' |
|
| 75 | ) { |
|
| 76 | /** @var int $len - Length of message (ciphertext + MAC) */ |
|
| 77 | $len = ParagonIE_Sodium_Core_Util::strlen($message); |
|
| 78 | ||
| 79 | /** @var int $clen - Length of ciphertext */ |
|
| 80 | $clen = $len - self::aead_chacha20poly1305_ABYTES; |
|
| 81 | ||
| 82 | /** @var int $adlen - Length of associated data */ |
|
| 83 | $adlen = ParagonIE_Sodium_Core_Util::strlen($ad); |
|
| 84 | ||
| 85 | /** @var string $mac - Message authentication code */ |
|
| 86 | $mac = ParagonIE_Sodium_Core_Util::substr( |
|
| 87 | $message, |
|
| 88 | $clen, |
|
| 89 | self::aead_chacha20poly1305_ABYTES |
|
| 90 | ); |
|
| 91 | ||
| 92 | /** @var string $ciphertext - The encrypted message (sans MAC) */ |
|
| 93 | $ciphertext = ParagonIE_Sodium_Core_Util::substr($message, 0, $clen); |
|
| 94 | ||
| 95 | /** @var string The first block of the chacha20 keystream, used as a poly1305 key */ |
|
| 96 | $block0 = ParagonIE_Sodium_Core_ChaCha20::stream( |
|
| 97 | 32, |
|
| 98 | $nonce, |
|
| 99 | $key |
|
| 100 | ); |
|
| 101 | ||
| 102 | /* Recalculate the Poly1305 authentication tag (MAC): */ |
|
| 103 | $state = new ParagonIE_Sodium_Core_Poly1305_State($block0); |
|
| 104 | try { |
|
| 105 | ParagonIE_Sodium_Compat::memzero($block0); |
|
| 106 | } catch (Error $ex) { |
|
| 107 | $block0 = null; |
|
| 108 | } |
|
| 109 | $state->update($ad); |
|
| 110 | $state->update(ParagonIE_Sodium_Core_Util::store64_le($adlen)); |
|
| 111 | $state->update($ciphertext); |
|
| 112 | $state->update(ParagonIE_Sodium_Core_Util::store64_le($clen)); |
|
| 113 | $computed_mac = $state->finish(); |
|
| 114 | ||
| 115 | /* Compare the given MAC with the recalculated MAC: */ |
|
| 116 | if (!ParagonIE_Sodium_Core_Util::verify_16($computed_mac, $mac)) { |
|
| 117 | throw new Error('Invalid MAC'); |
|
| 118 | } |
|
| 119 | ||
| 120 | // Here, we know that the MAC is valid, so we decrypt and return the plaintext |
|
| 121 | return ParagonIE_Sodium_Core_ChaCha20::streamXorIc( |
|
| 122 | $ciphertext, |
|
| 123 | $nonce, |
|
| 124 | $key, |
|
| 125 | ParagonIE_Sodium_Core_Util::store64_le(1) |
|
| 126 | ); |
|
| 127 | } |
|
| 128 | ||
| 129 | /** |
|
| 130 | * AEAD Encryption with ChaCha20-Poly1305 |
|
| @@ 70-127 (lines=58) @@ | ||
| 67 | * @return string |
|
| 68 | * @throws Error |
|
| 69 | */ |
|
| 70 | public static function aead_chacha20poly1305_decrypt( |
|
| 71 | $message = '', |
|
| 72 | $ad = '', |
|
| 73 | $nonce = '', |
|
| 74 | $key = '' |
|
| 75 | ) { |
|
| 76 | /** @var int $len - Length of message (ciphertext + MAC) */ |
|
| 77 | $len = ParagonIE_Sodium_Core32_Util::strlen($message); |
|
| 78 | ||
| 79 | /** @var int $clen - Length of ciphertext */ |
|
| 80 | $clen = $len - self::aead_chacha20poly1305_ABYTES; |
|
| 81 | ||
| 82 | /** @var int $adlen - Length of associated data */ |
|
| 83 | $adlen = ParagonIE_Sodium_Core32_Util::strlen($ad); |
|
| 84 | ||
| 85 | /** @var string $mac - Message authentication code */ |
|
| 86 | $mac = ParagonIE_Sodium_Core32_Util::substr( |
|
| 87 | $message, |
|
| 88 | $clen, |
|
| 89 | self::aead_chacha20poly1305_ABYTES |
|
| 90 | ); |
|
| 91 | ||
| 92 | /** @var string $ciphertext - The encrypted message (sans MAC) */ |
|
| 93 | $ciphertext = ParagonIE_Sodium_Core32_Util::substr($message, 0, $clen); |
|
| 94 | ||
| 95 | /** @var string The first block of the chacha20 keystream, used as a poly1305 key */ |
|
| 96 | $block0 = ParagonIE_Sodium_Core32_ChaCha20::stream( |
|
| 97 | 32, |
|
| 98 | $nonce, |
|
| 99 | $key |
|
| 100 | ); |
|
| 101 | ||
| 102 | /* Recalculate the Poly1305 authentication tag (MAC): */ |
|
| 103 | $state = new ParagonIE_Sodium_Core32_Poly1305_State($block0); |
|
| 104 | try { |
|
| 105 | ParagonIE_Sodium_Compat::memzero($block0); |
|
| 106 | } catch (Error $ex) { |
|
| 107 | $block0 = null; |
|
| 108 | } |
|
| 109 | $state->update($ad); |
|
| 110 | $state->update(ParagonIE_Sodium_Core32_Util::store64_le($adlen)); |
|
| 111 | $state->update($ciphertext); |
|
| 112 | $state->update(ParagonIE_Sodium_Core32_Util::store64_le($clen)); |
|
| 113 | $computed_mac = $state->finish(); |
|
| 114 | ||
| 115 | /* Compare the given MAC with the recalculated MAC: */ |
|
| 116 | if (!ParagonIE_Sodium_Core32_Util::verify_16($computed_mac, $mac)) { |
|
| 117 | throw new Error('Invalid MAC'); |
|
| 118 | } |
|
| 119 | ||
| 120 | // Here, we know that the MAC is valid, so we decrypt and return the plaintext |
|
| 121 | return ParagonIE_Sodium_Core32_ChaCha20::streamXorIc( |
|
| 122 | $ciphertext, |
|
| 123 | $nonce, |
|
| 124 | $key, |
|
| 125 | ParagonIE_Sodium_Core32_Util::store64_le(1) |
|
| 126 | ); |
|
| 127 | } |
|
| 128 | ||
| 129 | /** |
|
| 130 | * AEAD Encryption with ChaCha20-Poly1305 |
|