@@ -1,5 +1,5 @@ |
||
| 1 | 1 | <?php |
| 2 | -declare(strict_types=1); |
|
| 2 | +declare(strict_types = 1); |
|
| 3 | 3 | /** |
| 4 | 4 | * @copyright Copyright (c) 2016 Lukas Reschke <[email protected]> |
| 5 | 5 | * |
@@ -25,25 +25,25 @@ |
||
| 25 | 25 | namespace OC\Security\IdentityProof; |
| 26 | 26 | |
| 27 | 27 | class Key { |
| 28 | - /** @var string */ |
|
| 29 | - private $publicKey; |
|
| 30 | - /** @var string */ |
|
| 31 | - private $privateKey; |
|
| 28 | + /** @var string */ |
|
| 29 | + private $publicKey; |
|
| 30 | + /** @var string */ |
|
| 31 | + private $privateKey; |
|
| 32 | 32 | |
| 33 | - /** |
|
| 34 | - * @param string $publicKey |
|
| 35 | - * @param string $privateKey |
|
| 36 | - */ |
|
| 37 | - public function __construct(string $publicKey, string $privateKey) { |
|
| 38 | - $this->publicKey = $publicKey; |
|
| 39 | - $this->privateKey = $privateKey; |
|
| 40 | - } |
|
| 33 | + /** |
|
| 34 | + * @param string $publicKey |
|
| 35 | + * @param string $privateKey |
|
| 36 | + */ |
|
| 37 | + public function __construct(string $publicKey, string $privateKey) { |
|
| 38 | + $this->publicKey = $publicKey; |
|
| 39 | + $this->privateKey = $privateKey; |
|
| 40 | + } |
|
| 41 | 41 | |
| 42 | - public function getPrivate(): string { |
|
| 43 | - return $this->privateKey; |
|
| 44 | - } |
|
| 42 | + public function getPrivate(): string { |
|
| 43 | + return $this->privateKey; |
|
| 44 | + } |
|
| 45 | 45 | |
| 46 | - public function getPublic(): string { |
|
| 47 | - return $this->publicKey; |
|
| 48 | - } |
|
| 46 | + public function getPublic(): string { |
|
| 47 | + return $this->publicKey; |
|
| 48 | + } |
|
| 49 | 49 | } |
@@ -33,116 +33,116 @@ |
||
| 33 | 33 | use OCP\Security\ICrypto; |
| 34 | 34 | |
| 35 | 35 | class Manager { |
| 36 | - /** @var IAppData */ |
|
| 37 | - private $appData; |
|
| 38 | - /** @var ICrypto */ |
|
| 39 | - private $crypto; |
|
| 40 | - /** @var IConfig */ |
|
| 41 | - private $config; |
|
| 42 | - |
|
| 43 | - /** |
|
| 44 | - * @param Factory $appDataFactory |
|
| 45 | - * @param ICrypto $crypto |
|
| 46 | - * @param IConfig $config |
|
| 47 | - */ |
|
| 48 | - public function __construct(Factory $appDataFactory, |
|
| 49 | - ICrypto $crypto, |
|
| 50 | - IConfig $config |
|
| 51 | - ) { |
|
| 52 | - $this->appData = $appDataFactory->get('identityproof'); |
|
| 53 | - $this->crypto = $crypto; |
|
| 54 | - $this->config = $config; |
|
| 55 | - } |
|
| 56 | - |
|
| 57 | - /** |
|
| 58 | - * Calls the openssl functions to generate a public and private key. |
|
| 59 | - * In a separate function for unit testing purposes. |
|
| 60 | - * |
|
| 61 | - * @return array [$publicKey, $privateKey] |
|
| 62 | - */ |
|
| 63 | - protected function generateKeyPair(): array { |
|
| 64 | - $config = [ |
|
| 65 | - 'digest_alg' => 'sha512', |
|
| 66 | - 'private_key_bits' => 2048, |
|
| 67 | - ]; |
|
| 68 | - |
|
| 69 | - // Generate new key |
|
| 70 | - $res = openssl_pkey_new($config); |
|
| 71 | - openssl_pkey_export($res, $privateKey); |
|
| 72 | - |
|
| 73 | - // Extract the public key from $res to $pubKey |
|
| 74 | - $publicKey = openssl_pkey_get_details($res); |
|
| 75 | - $publicKey = $publicKey['key']; |
|
| 76 | - |
|
| 77 | - return [$publicKey, $privateKey]; |
|
| 78 | - } |
|
| 79 | - |
|
| 80 | - /** |
|
| 81 | - * Generate a key for a given ID |
|
| 82 | - * Note: If a key already exists it will be overwritten |
|
| 83 | - * |
|
| 84 | - * @param string $id key id |
|
| 85 | - * @return Key |
|
| 86 | - */ |
|
| 87 | - protected function generateKey(string $id): Key { |
|
| 88 | - list($publicKey, $privateKey) = $this->generateKeyPair(); |
|
| 89 | - |
|
| 90 | - // Write the private and public key to the disk |
|
| 91 | - try { |
|
| 92 | - $this->appData->newFolder($id); |
|
| 93 | - } catch (\Exception $e) {} |
|
| 94 | - $folder = $this->appData->getFolder($id); |
|
| 95 | - $folder->newFile('private') |
|
| 96 | - ->putContent($this->crypto->encrypt($privateKey)); |
|
| 97 | - $folder->newFile('public') |
|
| 98 | - ->putContent($publicKey); |
|
| 99 | - |
|
| 100 | - return new Key($publicKey, $privateKey); |
|
| 101 | - } |
|
| 102 | - |
|
| 103 | - /** |
|
| 104 | - * Get key for a specific id |
|
| 105 | - * |
|
| 106 | - * @param string $id |
|
| 107 | - * @return Key |
|
| 108 | - */ |
|
| 109 | - protected function retrieveKey(string $id): Key { |
|
| 110 | - try { |
|
| 111 | - $folder = $this->appData->getFolder($id); |
|
| 112 | - $privateKey = $this->crypto->decrypt( |
|
| 113 | - $folder->getFile('private')->getContent() |
|
| 114 | - ); |
|
| 115 | - $publicKey = $folder->getFile('public')->getContent(); |
|
| 116 | - return new Key($publicKey, $privateKey); |
|
| 117 | - } catch (\Exception $e) { |
|
| 118 | - return $this->generateKey($id); |
|
| 119 | - } |
|
| 120 | - } |
|
| 121 | - |
|
| 122 | - /** |
|
| 123 | - * Get public and private key for $user |
|
| 124 | - * |
|
| 125 | - * @param IUser $user |
|
| 126 | - * @return Key |
|
| 127 | - */ |
|
| 128 | - public function getKey(IUser $user): Key { |
|
| 129 | - $uid = $user->getUID(); |
|
| 130 | - return $this->retrieveKey('user-' . $uid); |
|
| 131 | - } |
|
| 132 | - |
|
| 133 | - /** |
|
| 134 | - * Get instance wide public and private key |
|
| 135 | - * |
|
| 136 | - * @return Key |
|
| 137 | - * @throws \RuntimeException |
|
| 138 | - */ |
|
| 139 | - public function getSystemKey(): Key { |
|
| 140 | - $instanceId = $this->config->getSystemValue('instanceid', null); |
|
| 141 | - if ($instanceId === null) { |
|
| 142 | - throw new \RuntimeException('no instance id!'); |
|
| 143 | - } |
|
| 144 | - return $this->retrieveKey('system-' . $instanceId); |
|
| 145 | - } |
|
| 36 | + /** @var IAppData */ |
|
| 37 | + private $appData; |
|
| 38 | + /** @var ICrypto */ |
|
| 39 | + private $crypto; |
|
| 40 | + /** @var IConfig */ |
|
| 41 | + private $config; |
|
| 42 | + |
|
| 43 | + /** |
|
| 44 | + * @param Factory $appDataFactory |
|
| 45 | + * @param ICrypto $crypto |
|
| 46 | + * @param IConfig $config |
|
| 47 | + */ |
|
| 48 | + public function __construct(Factory $appDataFactory, |
|
| 49 | + ICrypto $crypto, |
|
| 50 | + IConfig $config |
|
| 51 | + ) { |
|
| 52 | + $this->appData = $appDataFactory->get('identityproof'); |
|
| 53 | + $this->crypto = $crypto; |
|
| 54 | + $this->config = $config; |
|
| 55 | + } |
|
| 56 | + |
|
| 57 | + /** |
|
| 58 | + * Calls the openssl functions to generate a public and private key. |
|
| 59 | + * In a separate function for unit testing purposes. |
|
| 60 | + * |
|
| 61 | + * @return array [$publicKey, $privateKey] |
|
| 62 | + */ |
|
| 63 | + protected function generateKeyPair(): array { |
|
| 64 | + $config = [ |
|
| 65 | + 'digest_alg' => 'sha512', |
|
| 66 | + 'private_key_bits' => 2048, |
|
| 67 | + ]; |
|
| 68 | + |
|
| 69 | + // Generate new key |
|
| 70 | + $res = openssl_pkey_new($config); |
|
| 71 | + openssl_pkey_export($res, $privateKey); |
|
| 72 | + |
|
| 73 | + // Extract the public key from $res to $pubKey |
|
| 74 | + $publicKey = openssl_pkey_get_details($res); |
|
| 75 | + $publicKey = $publicKey['key']; |
|
| 76 | + |
|
| 77 | + return [$publicKey, $privateKey]; |
|
| 78 | + } |
|
| 79 | + |
|
| 80 | + /** |
|
| 81 | + * Generate a key for a given ID |
|
| 82 | + * Note: If a key already exists it will be overwritten |
|
| 83 | + * |
|
| 84 | + * @param string $id key id |
|
| 85 | + * @return Key |
|
| 86 | + */ |
|
| 87 | + protected function generateKey(string $id): Key { |
|
| 88 | + list($publicKey, $privateKey) = $this->generateKeyPair(); |
|
| 89 | + |
|
| 90 | + // Write the private and public key to the disk |
|
| 91 | + try { |
|
| 92 | + $this->appData->newFolder($id); |
|
| 93 | + } catch (\Exception $e) {} |
|
| 94 | + $folder = $this->appData->getFolder($id); |
|
| 95 | + $folder->newFile('private') |
|
| 96 | + ->putContent($this->crypto->encrypt($privateKey)); |
|
| 97 | + $folder->newFile('public') |
|
| 98 | + ->putContent($publicKey); |
|
| 99 | + |
|
| 100 | + return new Key($publicKey, $privateKey); |
|
| 101 | + } |
|
| 102 | + |
|
| 103 | + /** |
|
| 104 | + * Get key for a specific id |
|
| 105 | + * |
|
| 106 | + * @param string $id |
|
| 107 | + * @return Key |
|
| 108 | + */ |
|
| 109 | + protected function retrieveKey(string $id): Key { |
|
| 110 | + try { |
|
| 111 | + $folder = $this->appData->getFolder($id); |
|
| 112 | + $privateKey = $this->crypto->decrypt( |
|
| 113 | + $folder->getFile('private')->getContent() |
|
| 114 | + ); |
|
| 115 | + $publicKey = $folder->getFile('public')->getContent(); |
|
| 116 | + return new Key($publicKey, $privateKey); |
|
| 117 | + } catch (\Exception $e) { |
|
| 118 | + return $this->generateKey($id); |
|
| 119 | + } |
|
| 120 | + } |
|
| 121 | + |
|
| 122 | + /** |
|
| 123 | + * Get public and private key for $user |
|
| 124 | + * |
|
| 125 | + * @param IUser $user |
|
| 126 | + * @return Key |
|
| 127 | + */ |
|
| 128 | + public function getKey(IUser $user): Key { |
|
| 129 | + $uid = $user->getUID(); |
|
| 130 | + return $this->retrieveKey('user-' . $uid); |
|
| 131 | + } |
|
| 132 | + |
|
| 133 | + /** |
|
| 134 | + * Get instance wide public and private key |
|
| 135 | + * |
|
| 136 | + * @return Key |
|
| 137 | + * @throws \RuntimeException |
|
| 138 | + */ |
|
| 139 | + public function getSystemKey(): Key { |
|
| 140 | + $instanceId = $this->config->getSystemValue('instanceid', null); |
|
| 141 | + if ($instanceId === null) { |
|
| 142 | + throw new \RuntimeException('no instance id!'); |
|
| 143 | + } |
|
| 144 | + return $this->retrieveKey('system-' . $instanceId); |
|
| 145 | + } |
|
| 146 | 146 | |
| 147 | 147 | |
| 148 | 148 | } |
@@ -1,5 +1,5 @@ discard block |
||
| 1 | 1 | <?php |
| 2 | -declare(strict_types=1); |
|
| 2 | +declare(strict_types = 1); |
|
| 3 | 3 | /** |
| 4 | 4 | * @copyright Copyright (c) 2016 Lukas Reschke <[email protected]> |
| 5 | 5 | * |
@@ -127,7 +127,7 @@ discard block |
||
| 127 | 127 | */ |
| 128 | 128 | public function getKey(IUser $user): Key { |
| 129 | 129 | $uid = $user->getUID(); |
| 130 | - return $this->retrieveKey('user-' . $uid); |
|
| 130 | + return $this->retrieveKey('user-'.$uid); |
|
| 131 | 131 | } |
| 132 | 132 | |
| 133 | 133 | /** |
@@ -141,7 +141,7 @@ discard block |
||
| 141 | 141 | if ($instanceId === null) { |
| 142 | 142 | throw new \RuntimeException('no instance id!'); |
| 143 | 143 | } |
| 144 | - return $this->retrieveKey('system-' . $instanceId); |
|
| 144 | + return $this->retrieveKey('system-'.$instanceId); |
|
| 145 | 145 | } |
| 146 | 146 | |
| 147 | 147 | |
@@ -30,76 +30,76 @@ |
||
| 30 | 30 | use OCP\IUserManager; |
| 31 | 31 | |
| 32 | 32 | class Signer { |
| 33 | - /** @var Manager */ |
|
| 34 | - private $keyManager; |
|
| 35 | - /** @var ITimeFactory */ |
|
| 36 | - private $timeFactory; |
|
| 37 | - /** @var IUserManager */ |
|
| 38 | - private $userManager; |
|
| 33 | + /** @var Manager */ |
|
| 34 | + private $keyManager; |
|
| 35 | + /** @var ITimeFactory */ |
|
| 36 | + private $timeFactory; |
|
| 37 | + /** @var IUserManager */ |
|
| 38 | + private $userManager; |
|
| 39 | 39 | |
| 40 | - /** |
|
| 41 | - * @param Manager $keyManager |
|
| 42 | - * @param ITimeFactory $timeFactory |
|
| 43 | - * @param IUserManager $userManager |
|
| 44 | - */ |
|
| 45 | - public function __construct(Manager $keyManager, |
|
| 46 | - ITimeFactory $timeFactory, |
|
| 47 | - IUserManager $userManager) { |
|
| 48 | - $this->keyManager = $keyManager; |
|
| 49 | - $this->timeFactory = $timeFactory; |
|
| 50 | - $this->userManager = $userManager; |
|
| 51 | - } |
|
| 40 | + /** |
|
| 41 | + * @param Manager $keyManager |
|
| 42 | + * @param ITimeFactory $timeFactory |
|
| 43 | + * @param IUserManager $userManager |
|
| 44 | + */ |
|
| 45 | + public function __construct(Manager $keyManager, |
|
| 46 | + ITimeFactory $timeFactory, |
|
| 47 | + IUserManager $userManager) { |
|
| 48 | + $this->keyManager = $keyManager; |
|
| 49 | + $this->timeFactory = $timeFactory; |
|
| 50 | + $this->userManager = $userManager; |
|
| 51 | + } |
|
| 52 | 52 | |
| 53 | - /** |
|
| 54 | - * Returns a signed blob for $data |
|
| 55 | - * |
|
| 56 | - * @param string $type |
|
| 57 | - * @param array $data |
|
| 58 | - * @param IUser $user |
|
| 59 | - * @return array ['message', 'signature'] |
|
| 60 | - */ |
|
| 61 | - public function sign(string $type, array $data, IUser $user): array { |
|
| 62 | - $privateKey = $this->keyManager->getKey($user)->getPrivate(); |
|
| 63 | - $data = [ |
|
| 64 | - 'data' => $data, |
|
| 65 | - 'type' => $type, |
|
| 66 | - 'signer' => $user->getCloudId(), |
|
| 67 | - 'timestamp' => $this->timeFactory->getTime(), |
|
| 68 | - ]; |
|
| 69 | - openssl_sign(json_encode($data), $signature, $privateKey, OPENSSL_ALGO_SHA512); |
|
| 53 | + /** |
|
| 54 | + * Returns a signed blob for $data |
|
| 55 | + * |
|
| 56 | + * @param string $type |
|
| 57 | + * @param array $data |
|
| 58 | + * @param IUser $user |
|
| 59 | + * @return array ['message', 'signature'] |
|
| 60 | + */ |
|
| 61 | + public function sign(string $type, array $data, IUser $user): array { |
|
| 62 | + $privateKey = $this->keyManager->getKey($user)->getPrivate(); |
|
| 63 | + $data = [ |
|
| 64 | + 'data' => $data, |
|
| 65 | + 'type' => $type, |
|
| 66 | + 'signer' => $user->getCloudId(), |
|
| 67 | + 'timestamp' => $this->timeFactory->getTime(), |
|
| 68 | + ]; |
|
| 69 | + openssl_sign(json_encode($data), $signature, $privateKey, OPENSSL_ALGO_SHA512); |
|
| 70 | 70 | |
| 71 | - return [ |
|
| 72 | - 'message' => $data, |
|
| 73 | - 'signature' => base64_encode($signature), |
|
| 74 | - ]; |
|
| 75 | - } |
|
| 71 | + return [ |
|
| 72 | + 'message' => $data, |
|
| 73 | + 'signature' => base64_encode($signature), |
|
| 74 | + ]; |
|
| 75 | + } |
|
| 76 | 76 | |
| 77 | - /** |
|
| 78 | - * Whether the data is signed properly |
|
| 79 | - * |
|
| 80 | - * @param array $data |
|
| 81 | - * @return bool |
|
| 82 | - */ |
|
| 83 | - public function verify(array $data): bool { |
|
| 84 | - if(isset($data['message']) |
|
| 85 | - && isset($data['signature']) |
|
| 86 | - && isset($data['message']['signer']) |
|
| 87 | - ) { |
|
| 88 | - $location = strrpos($data['message']['signer'], '@'); |
|
| 89 | - $userId = substr($data['message']['signer'], 0, $location); |
|
| 77 | + /** |
|
| 78 | + * Whether the data is signed properly |
|
| 79 | + * |
|
| 80 | + * @param array $data |
|
| 81 | + * @return bool |
|
| 82 | + */ |
|
| 83 | + public function verify(array $data): bool { |
|
| 84 | + if(isset($data['message']) |
|
| 85 | + && isset($data['signature']) |
|
| 86 | + && isset($data['message']['signer']) |
|
| 87 | + ) { |
|
| 88 | + $location = strrpos($data['message']['signer'], '@'); |
|
| 89 | + $userId = substr($data['message']['signer'], 0, $location); |
|
| 90 | 90 | |
| 91 | - $user = $this->userManager->get($userId); |
|
| 92 | - if($user !== null) { |
|
| 93 | - $key = $this->keyManager->getKey($user); |
|
| 94 | - return (bool)openssl_verify( |
|
| 95 | - json_encode($data['message']), |
|
| 96 | - base64_decode($data['signature']), |
|
| 97 | - $key->getPublic(), |
|
| 98 | - OPENSSL_ALGO_SHA512 |
|
| 99 | - ); |
|
| 100 | - } |
|
| 101 | - } |
|
| 91 | + $user = $this->userManager->get($userId); |
|
| 92 | + if($user !== null) { |
|
| 93 | + $key = $this->keyManager->getKey($user); |
|
| 94 | + return (bool)openssl_verify( |
|
| 95 | + json_encode($data['message']), |
|
| 96 | + base64_decode($data['signature']), |
|
| 97 | + $key->getPublic(), |
|
| 98 | + OPENSSL_ALGO_SHA512 |
|
| 99 | + ); |
|
| 100 | + } |
|
| 101 | + } |
|
| 102 | 102 | |
| 103 | - return false; |
|
| 104 | - } |
|
| 103 | + return false; |
|
| 104 | + } |
|
| 105 | 105 | } |
@@ -1,5 +1,5 @@ discard block |
||
| 1 | 1 | <?php |
| 2 | -declare(strict_types=1); |
|
| 2 | +declare(strict_types = 1); |
|
| 3 | 3 | /** |
| 4 | 4 | * @copyright Copyright (c) 2016 Lukas Reschke <[email protected]> |
| 5 | 5 | * |
@@ -81,7 +81,7 @@ discard block |
||
| 81 | 81 | * @return bool |
| 82 | 82 | */ |
| 83 | 83 | public function verify(array $data): bool { |
| 84 | - if(isset($data['message']) |
|
| 84 | + if (isset($data['message']) |
|
| 85 | 85 | && isset($data['signature']) |
| 86 | 86 | && isset($data['message']['signer']) |
| 87 | 87 | ) { |
@@ -89,9 +89,9 @@ discard block |
||
| 89 | 89 | $userId = substr($data['message']['signer'], 0, $location); |
| 90 | 90 | |
| 91 | 91 | $user = $this->userManager->get($userId); |
| 92 | - if($user !== null) { |
|
| 92 | + if ($user !== null) { |
|
| 93 | 93 | $key = $this->keyManager->getKey($user); |
| 94 | - return (bool)openssl_verify( |
|
| 94 | + return (bool) openssl_verify( |
|
| 95 | 95 | json_encode($data['message']), |
| 96 | 96 | base64_decode($data['signature']), |
| 97 | 97 | $key->getPublic(), |