LaravelEncrypter::generateKey() - Code Metrics - hendeavors/components-encryption - Measure and Improve Code Quality continuously with Scrutinizer

LaravelEncrypter::generateKey() A
last analyzed 2018-10-24 16:04 UTC

↳ Parent: LaravelEncrypter

Complexity

Conditions	2
Paths	1

Size

Total Lines	3
Code Lines	1

Duplication

Lines	0
Ratio	0 %

Importance

Changes

Metric	Value
cc	2
eloc	1
nc	1
nop	1
dl	0
loc	3
rs	10
c	0
b	0
f	0

<?php

namespace Endeavors\Components\Encryption;

use RuntimeException;
use Illuminate\Encryption\DecryptException;
use Endeavors\Components\Encryption\Contracts\IOriginalEncrypter;
use Endeavors\Components\Encryption\Contracts\EncryptException;

class LaravelEncrypter implements IOriginalEncrypter
{
    /**
     * The encryption key.
     *
     * @var string
     */
    protected $key;

    /**
     * The algorithm used for encryption.
     *
     * @var string
     */
    protected $cipher;

    /**
     * Create a new encrypter instance.
     *
     * @param  string  $key
     * @param  string  $cipher
     * @return void
     *
     * @throws \RuntimeException
     */
    public function __construct($key, $cipher = 'AES-128-CBC')
    {
        $key = (string) $key;

        if (static::supported($key, $cipher)) {
            $this->key = $key;
            $this->cipher = $cipher;
        } else {
            throw new RuntimeException('The only supported ciphers are AES-128-CBC and AES-256-CBC with the correct key lengths.');
        }
    }

    /**
     * Determine if the given key and cipher combination is valid.
     *
     * @param  string  $key
     * @param  string  $cipher
     * @return bool
     */
    public static function supported($key, $cipher)
    {
        $length = mb_strlen($key, '8bit');

        return ($cipher === 'AES-128-CBC' && $length === 16) ||
               ($cipher === 'AES-256-CBC' && $length === 32);
    }

    /**
     * Create a new encryption key for the given cipher.
     *
     * @param  string  $cipher
     * @return string
     */
    public static function generateKey($cipher)
    {
        return random_bytes($cipher == 'AES-128-CBC' ? 16 : 32);
    }

    /**
     * Encrypt the given value.
     *
     * @param  mixed  $value
     * @param  bool  $serialize
     * @return string
     *
     * @throws \Endeavors\Components\Encryption\Contracts\EncryptException
     */
    public function encrypt($value, $serialize = true)
    {
        $iv = random_bytes(openssl_cipher_iv_length($this->cipher));

        // First we will encrypt the value using OpenSSL. After this is encrypted we
        // will proceed to calculating a MAC for the encrypted value so that this
        // value can be verified later as not having been changed by the users.
        $value = \openssl_encrypt(
            $serialize ? serialize($value) : $value,
            $this->cipher, $this->key, 0, $iv
        );

        if ($value === false) {
            throw new EncryptException('Could not encrypt the data.');
        }

        // Once we get the encrypted value we'll go ahead and base64_encode the input
        // vector and create the MAC for the encrypted value so we can then verify
        // its authenticity. Then, we'll JSON the data into the "payload" array.
        $mac = $this->hash($iv = base64_encode($iv), $value);

        $json = json_encode(compact('iv', 'value', 'mac'));

        if (json_last_error() !== JSON_ERROR_NONE) {
            throw new EncryptException('Could not encrypt the data.');
        }

        return base64_encode($json);
    }

    /**
     * Encrypt a string without serialization.
     *
     * @param  string  $value
     * @return string
     */
    public function encryptString($value)
    {
        return $this->encrypt($value, false);
    }

    /**
     * Decrypt the given value.
     *
     * @param  mixed  $payload
     * @param  bool  $unserialize
     * @return string
     *
     * @throws \Illuminate\Encryption\DecryptException
     */
    public function decrypt($payload, $unserialize = true)
    {
        $payload = $this->getJsonPayload($payload);

        $iv = base64_decode($payload['iv']);

        // Here we will decrypt the value. If we are able to successfully decrypt it
        // we will then unserialize it and return it out to the caller. If we are
        // unable to decrypt this value we will throw out an exception message.
        $decrypted = \openssl_decrypt(
            $payload['value'], $this->cipher, $this->key, 0, $iv
        );

        if ($decrypted === false) {
            throw new DecryptException('Could not decrypt the data.');
        }

        return $unserialize ? unserialize($decrypted) : $decrypted;
    }

    /**
     * Decrypt the given string without unserialization.
     *
     * @param  string  $payload
     * @return string
     */
    public function decryptString($payload)
    {
        return $this->decrypt($payload, false);
    }

    /**
     * Create a MAC for the given value.
     *
     * @param  string  $iv
     * @param  mixed  $value
     * @return string
     */
    protected function hash($iv, $value)
    {
        return hash_hmac('sha256', $iv.$value, $this->key);
    }

    /**
     * Get the JSON array from the given payload.
     *
     * @param  string  $payload
     * @return array
     *
     * @throws \Illuminate\Encryption\DecryptException
     */
    protected function getJsonPayload($payload)
    {
        $payload = json_decode(base64_decode($payload), true);

        // If the payload is not valid JSON or does not have the proper keys set we will
        // assume it is invalid and bail out of the routine since we will not be able
        // to decrypt the given value. We'll also check the MAC for this encryption.
        if (! $this->validPayload($payload)) {
            throw new DecryptException('The payload is invalid.');
        }

        if (! $this->validMac($payload)) {
            throw new DecryptException('The MAC is invalid.');
        }

        return $payload;
    }

    /**
     * Verify that the encryption payload is valid.
     *
     * @param  mixed  $payload
     * @return bool
     */
    protected function validPayload($payload)
    {
        return is_array($payload) && isset($payload['iv'], $payload['value'], $payload['mac']) &&
               strlen(base64_decode($payload['iv'], true)) === openssl_cipher_iv_length($this->cipher);
    }

    /**
     * Determine if the MAC for the given payload is valid.
     *
     * @param  array  $payload
     * @return bool
     */
    protected function validMac(array $payload)
    {
        $calculated = $this->calculateMac($payload, $bytes = random_bytes(16));

        return hash_equals(
            hash_hmac('sha256', $payload['mac'], $bytes, true), $calculated
        );
    }

    /**
     * Calculate the hash of the given payload.
     *
     * @param  array  $payload
     * @param  string  $bytes
     * @return string
     */
    protected function calculateMac($payload, $bytes)
    {
        return hash_hmac(
            'sha256', $this->hash($payload['iv'], $payload['value']), $bytes, true
        );
    }

    /**
     * Get the encryption key.
     *
     * @return string
     */
    public function getKey()
    {
        return $this->key;
    }
}

1			<?php
2
3			namespace Endeavors\Components\Encryption;
4
5			use RuntimeException;
6			use Illuminate\Encryption\DecryptException;
7			use Endeavors\Components\Encryption\Contracts\IOriginalEncrypter;
8			use Endeavors\Components\Encryption\Contracts\EncryptException;
9
10			class LaravelEncrypter implements IOriginalEncrypter
11			{
12			/**
13			* The encryption key.
14			*
15			* @var string
16			*/
17			protected $key;
18
19			/**
20			* The algorithm used for encryption.
21			*
22			* @var string
23			*/
24			protected $cipher;
25
26			/**
27			* Create a new encrypter instance.
28			*
29			* @param string $key
30			* @param string $cipher
31			* @return void
32			*
33			* @throws \RuntimeException
34			*/
35			public function __construct($key, $cipher = 'AES-128-CBC')
36			{
37			$key = (string) $key;
38
39			if (static::supported($key, $cipher)) {
40			$this->key = $key;
41			$this->cipher = $cipher;
42			} else {
43			throw new RuntimeException('The only supported ciphers are AES-128-CBC and AES-256-CBC with the correct key lengths.');
44			}
45			}
46
47			/**
48			* Determine if the given key and cipher combination is valid.
49			*
50			* @param string $key
51			* @param string $cipher
52			* @return bool
53			*/
54			public static function supported($key, $cipher)
55			{
56			$length = mb_strlen($key, '8bit');
57
58			return ($cipher === 'AES-128-CBC' && $length === 16) \|\|
59			($cipher === 'AES-256-CBC' && $length === 32);
60			}
61
62			/**
63			* Create a new encryption key for the given cipher.
64			*
65			* @param string $cipher
66			* @return string
67			*/
68			public static function generateKey($cipher)
69			{
70			return random_bytes($cipher == 'AES-128-CBC' ? 16 : 32);
71			}
72
73			/**
74			* Encrypt the given value.
75			*
76			* @param mixed $value
77			* @param bool $serialize
78			* @return string
79			*
80			* @throws \Endeavors\Components\Encryption\Contracts\EncryptException
81			*/
82			public function encrypt($value, $serialize = true)
83			{
84			$iv = random_bytes(openssl_cipher_iv_length($this->cipher));
85
86			// First we will encrypt the value using OpenSSL. After this is encrypted we
87			// will proceed to calculating a MAC for the encrypted value so that this
88			// value can be verified later as not having been changed by the users.
89			$value = \openssl_encrypt(
90			$serialize ? serialize($value) : $value,
91			$this->cipher, $this->key, 0, $iv
92			);
93
94			if ($value === false) {
95			throw new EncryptException('Could not encrypt the data.');
96			}
97
98			// Once we get the encrypted value we'll go ahead and base64_encode the input
99			// vector and create the MAC for the encrypted value so we can then verify
100			// its authenticity. Then, we'll JSON the data into the "payload" array.
101			$mac = $this->hash($iv = base64_encode($iv), $value);
102
103			$json = json_encode(compact('iv', 'value', 'mac'));
104
105			if (json_last_error() !== JSON_ERROR_NONE) {
106			throw new EncryptException('Could not encrypt the data.');
107			}
108
109			return base64_encode($json);
110			}
111
112			/**
113			* Encrypt a string without serialization.
114			*
115			* @param string $value
116			* @return string
117			*/
118			public function encryptString($value)
119			{
120			return $this->encrypt($value, false);
121			}
122
123			/**
124			* Decrypt the given value.
125			*
126			* @param mixed $payload
127			* @param bool $unserialize
128			* @return string
129			*
130			* @throws \Illuminate\Encryption\DecryptException
131			*/
132			public function decrypt($payload, $unserialize = true)
133			{
134			$payload = $this->getJsonPayload($payload);
135
136			$iv = base64_decode($payload['iv']);
137
138			// Here we will decrypt the value. If we are able to successfully decrypt it
139			// we will then unserialize it and return it out to the caller. If we are
140			// unable to decrypt this value we will throw out an exception message.
141			$decrypted = \openssl_decrypt(
142			$payload['value'], $this->cipher, $this->key, 0, $iv
143			);
144
145			if ($decrypted === false) {
146			throw new DecryptException('Could not decrypt the data.');
147			}
148
149			return $unserialize ? unserialize($decrypted) : $decrypted;
150			}
151
152			/**
153			* Decrypt the given string without unserialization.
154			*
155			* @param string $payload
156			* @return string
157			*/
158			public function decryptString($payload)
159			{
160			return $this->decrypt($payload, false);
161			}
162
163			/**
164			* Create a MAC for the given value.
165			*
166			* @param string $iv
167			* @param mixed $value
168			* @return string
169			*/
170			protected function hash($iv, $value)
171			{
172			return hash_hmac('sha256', $iv.$value, $this->key);
173			}
174
175			/**
176			* Get the JSON array from the given payload.
177			*
178			* @param string $payload
179			* @return array
180			*
181			* @throws \Illuminate\Encryption\DecryptException
182			*/
183			protected function getJsonPayload($payload)
184			{
185			$payload = json_decode(base64_decode($payload), true);
186
187			// If the payload is not valid JSON or does not have the proper keys set we will
188			// assume it is invalid and bail out of the routine since we will not be able
189			// to decrypt the given value. We'll also check the MAC for this encryption.
190			if (! $this->validPayload($payload)) {
191			throw new DecryptException('The payload is invalid.');
192			}
193
194			if (! $this->validMac($payload)) {
195			throw new DecryptException('The MAC is invalid.');
196			}
197
198			return $payload;
199			}
200
201			/**
202			* Verify that the encryption payload is valid.
203			*
204			* @param mixed $payload
205			* @return bool
206			*/
207			protected function validPayload($payload)
208			{
209			return is_array($payload) && isset($payload['iv'], $payload['value'], $payload['mac']) &&
210			strlen(base64_decode($payload['iv'], true)) === openssl_cipher_iv_length($this->cipher);
211			}
212
213			/**
214			* Determine if the MAC for the given payload is valid.
215			*
216			* @param array $payload
217			* @return bool
218			*/
219			protected function validMac(array $payload)
220			{
221			$calculated = $this->calculateMac($payload, $bytes = random_bytes(16));
222
223			return hash_equals(
224			hash_hmac('sha256', $payload['mac'], $bytes, true), $calculated
225			);
226			}
227
228			/**
229			* Calculate the hash of the given payload.
230			*
231			* @param array $payload
232			* @param string $bytes
233			* @return string
234			*/
235			protected function calculateMac($payload, $bytes)
236			{
237			return hash_hmac(
238			'sha256', $this->hash($payload['iv'], $payload['value']), $bytes, true
239			);
240			}
241
242			/**
243			* Get the encryption key.
244			*
245			* @return string
246			*/
247			public function getKey()
248			{
249			return $this->key;
250			}
251			}

hendeavors / components-encryption

LaravelEncrypter::generateKey() A last analyzed 2018-10-24 16:04 UTC

Complexity

Size

Duplication

Importance

Duplication Side-by-Side

Filter issues like

LaravelEncrypter::generateKey() A
last analyzed 2018-10-24 16:04 UTC