nextcloud / server

lib/private/Security/Crypto.php

Indentation +88 added lines, -88 removed lines

@@ -43,93 +43,93 @@
  * @package OC\Security
  */
 class Crypto implements ICrypto {
-	/** @var AES $cipher */
-	private $cipher;
-	/** @var int */
-	private $ivLength = 16;
-	/** @var IConfig */
-	private $config;
-	/** @var ISecureRandom */
-	private $random;
-
-	/**
-	 * @param IConfig $config
-	 * @param ISecureRandom $random
-	 */
-	public function __construct(IConfig $config, ISecureRandom $random) {
-		$this->cipher = new AES();
-		$this->config = $config;
-		$this->random = $random;
-	}
-
-	/**
-	 * @param string $message The message to authenticate
-	 * @param string $password Password to use (defaults to `secret` in config.php)
-	 * @return string Calculated HMAC
-	 */
-	public function calculateHMAC($message, $password = '') {
-		if($password === '') {
-			$password = $this->config->getSystemValue('secret');
-		}
-
-		// Append an "a" behind the password and hash it to prevent reusing the same password as for encryption
-		$password = hash('sha512', $password . 'a');
-
-		$hash = new Hash('sha512');
-		$hash->setKey($password);
-		return $hash->hash($message);
-	}
-
-	/**
-	 * Encrypts a value and adds an HMAC (Encrypt-Then-MAC)
-	 * @param string $plaintext
-	 * @param string $password Password to encrypt, if not specified the secret from config.php will be taken
-	 * @return string Authenticated ciphertext
-	 */
-	public function encrypt($plaintext, $password = '') {
-		if($password === '') {
-			$password = $this->config->getSystemValue('secret');
-		}
-		$this->cipher->setPassword($password);
-
-		$iv = $this->random->generate($this->ivLength);
-		$this->cipher->setIV($iv);
-
-		$ciphertext = bin2hex($this->cipher->encrypt($plaintext));
-		$hmac = bin2hex($this->calculateHMAC($ciphertext.$iv, $password));
-
-		return $ciphertext.'|'.$iv.'|'.$hmac;
-	}
-
-	/**
-	 * Decrypts a value and verifies the HMAC (Encrypt-Then-Mac)
-	 * @param string $authenticatedCiphertext
-	 * @param string $password Password to encrypt, if not specified the secret from config.php will be taken
-	 * @return string plaintext
-	 * @throws \Exception If the HMAC does not match
-	 */
-	public function decrypt(string $authenticatedCiphertext, string $password = ''): string {
-		if($password === '') {
-			$password = $this->config->getSystemValue('secret');
-		}
-		$this->cipher->setPassword($password);
-
-		$parts = explode('|', $authenticatedCiphertext);
-		if(count($parts) !== 3) {
-			throw new \Exception('Authenticated ciphertext could not be decoded.');
-		}
-
-		$ciphertext = hex2bin($parts[0]);
-		$iv = $parts[1];
-		$hmac = hex2bin($parts[2]);
-
-		$this->cipher->setIV($iv);
-
-		if(!hash_equals($this->calculateHMAC($parts[0].$parts[1], $password), $hmac)) {
-			throw new \Exception('HMAC does not match.');
-		}
-
-		return $this->cipher->decrypt($ciphertext);
-	}
+    /** @var AES $cipher */
+    private $cipher;
+    /** @var int */
+    private $ivLength = 16;
+    /** @var IConfig */
+    private $config;
+    /** @var ISecureRandom */
+    private $random;
+
+    /**
+     * @param IConfig $config
+     * @param ISecureRandom $random
+     */
+    public function __construct(IConfig $config, ISecureRandom $random) {
+        $this->cipher = new AES();
+        $this->config = $config;
+        $this->random = $random;
+    }
+
+    /**
+     * @param string $message The message to authenticate
+     * @param string $password Password to use (defaults to `secret` in config.php)
+     * @return string Calculated HMAC
+     */
+    public function calculateHMAC($message, $password = '') {
+        if($password === '') {
+            $password = $this->config->getSystemValue('secret');
+        }
+
+        // Append an "a" behind the password and hash it to prevent reusing the same password as for encryption
+        $password = hash('sha512', $password . 'a');
+
+        $hash = new Hash('sha512');
+        $hash->setKey($password);
+        return $hash->hash($message);
+    }
+
+    /**
+     * Encrypts a value and adds an HMAC (Encrypt-Then-MAC)
+     * @param string $plaintext
+     * @param string $password Password to encrypt, if not specified the secret from config.php will be taken
+     * @return string Authenticated ciphertext
+     */
+    public function encrypt($plaintext, $password = '') {
+        if($password === '') {
+            $password = $this->config->getSystemValue('secret');
+        }
+        $this->cipher->setPassword($password);
+
+        $iv = $this->random->generate($this->ivLength);
+        $this->cipher->setIV($iv);
+
+        $ciphertext = bin2hex($this->cipher->encrypt($plaintext));
+        $hmac = bin2hex($this->calculateHMAC($ciphertext.$iv, $password));
+
+        return $ciphertext.'|'.$iv.'|'.$hmac;
+    }
+
+    /**
+     * Decrypts a value and verifies the HMAC (Encrypt-Then-Mac)
+     * @param string $authenticatedCiphertext
+     * @param string $password Password to encrypt, if not specified the secret from config.php will be taken
+     * @return string plaintext
+     * @throws \Exception If the HMAC does not match
+     */
+    public function decrypt(string $authenticatedCiphertext, string $password = ''): string {
+        if($password === '') {
+            $password = $this->config->getSystemValue('secret');
+        }
+        $this->cipher->setPassword($password);
+
+        $parts = explode('|', $authenticatedCiphertext);
+        if(count($parts) !== 3) {
+            throw new \Exception('Authenticated ciphertext could not be decoded.');
+        }
+
+        $ciphertext = hex2bin($parts[0]);
+        $iv = $parts[1];
+        $hmac = hex2bin($parts[2]);
+
+        $this->cipher->setIV($iv);
+
+        if(!hash_equals($this->calculateHMAC($parts[0].$parts[1], $password), $hmac)) {
+            throw new \Exception('HMAC does not match.');
+        }
+
+        return $this->cipher->decrypt($ciphertext);
+    }
 
 }

Spacing +6 added lines, -6 removed lines

@@ -68,12 +68,12 @@ 
 	 * @return string Calculated HMAC
 	 */
 	public function calculateHMAC($message, $password = '') {
-		if($password === '') {
+		if ($password === '') {
 			$password = $this->config->getSystemValue('secret');
 		}
 
 		// Append an "a" behind the password and hash it to prevent reusing the same password as for encryption
-		$password = hash('sha512', $password . 'a');
+		$password = hash('sha512', $password.'a');
 
 		$hash = new Hash('sha512');
 		$hash->setKey($password);
@@ -87,7 +87,7 @@ 
 	 * @return string Authenticated ciphertext
 	 */
 	public function encrypt($plaintext, $password = '') {
-		if($password === '') {
+		if ($password === '') {
 			$password = $this->config->getSystemValue('secret');
 		}
 		$this->cipher->setPassword($password);
@@ -109,13 +109,13 @@ 
 	 * @throws \Exception If the HMAC does not match
 	 */
 	public function decrypt(string $authenticatedCiphertext, string $password = ''): string {
-		if($password === '') {
+		if ($password === '') {
 			$password = $this->config->getSystemValue('secret');
 		}
 		$this->cipher->setPassword($password);
 
 		$parts = explode('|', $authenticatedCiphertext);
-		if(count($parts) !== 3) {
+		if (count($parts) !== 3) {
 			throw new \Exception('Authenticated ciphertext could not be decoded.');
 		}
 
@@ -125,7 +125,7 @@ 
 
 		$this->cipher->setIV($iv);
 
-		if(!hash_equals($this->calculateHMAC($parts[0].$parts[1], $password), $hmac)) {
+		if (!hash_equals($this->calculateHMAC($parts[0].$parts[1], $password), $hmac)) {
 			throw new \Exception('HMAC does not match.');
 		}
 

lib/public/Security/ICrypto.php

Indentation +24 added lines, -24 removed lines

@@ -36,30 +36,30 @@
  */
 interface ICrypto {
 
-	/**
-	 * @param string $message The message to authenticate
-	 * @param string $password Password to use (defaults to `secret` in config.php)
-	 * @return string Calculated HMAC
-	 * @since 8.0.0
-	 */
-	public function calculateHMAC($message, $password = '');
+    /**
+     * @param string $message The message to authenticate
+     * @param string $password Password to use (defaults to `secret` in config.php)
+     * @return string Calculated HMAC
+     * @since 8.0.0
+     */
+    public function calculateHMAC($message, $password = '');
 
-	/**
-	 * Encrypts a value and adds an HMAC (Encrypt-Then-MAC)
-	 * @param string $plaintext
-	 * @param string $password Password to encrypt, if not specified the secret from config.php will be taken
-	 * @return string Authenticated ciphertext
-	 * @since 8.0.0
-	 */
-	public function encrypt($plaintext, $password = '');
+    /**
+     * Encrypts a value and adds an HMAC (Encrypt-Then-MAC)
+     * @param string $plaintext
+     * @param string $password Password to encrypt, if not specified the secret from config.php will be taken
+     * @return string Authenticated ciphertext
+     * @since 8.0.0
+     */
+    public function encrypt($plaintext, $password = '');
 
-	/**
-	 * Decrypts a value and verifies the HMAC (Encrypt-Then-Mac)
-	 * @param string $authenticatedCiphertext
-	 * @param string $password Password to encrypt, if not specified the secret from config.php will be taken
-	 * @return string plaintext
-	 * @throws \Exception If the HMAC does not match
-	 * @since 8.0.0
-	 */
-	public function decrypt(string $authenticatedCiphertext, string $password = ''): string;
+    /**
+     * Decrypts a value and verifies the HMAC (Encrypt-Then-Mac)
+     * @param string $authenticatedCiphertext
+     * @param string $password Password to encrypt, if not specified the secret from config.php will be taken
+     * @return string plaintext
+     * @throws \Exception If the HMAC does not match
+     * @since 8.0.0
+     */
+    public function decrypt(string $authenticatedCiphertext, string $password = ''): string;
 }