CryptToolSodiumTests::testHexBin() - Code Metrics - Inspection of "[WIP] Use more cryptographical features of libsodi..." - rugk/threema-msgapi-sdk-php - Measure and Improve Code Quality continuously with Scrutinizer

Completed

Pull Request — master (#42)

by rugk

created 2016-09-17 21:37 UTC

CryptToolSodiumTests::testHexBin() B

↳ Parent: CryptToolSodiumTests

Complexity

Conditions	2
Paths	2

Size

Total Lines	40
Code Lines	24

Duplication

Lines	0
Ratio	0 %

Importance

Changes

Metric	Value
dl	0
loc	40
rs	8.8571
c	0
b	0
f	0
cc	2
eloc	24
nc	2
nop	0

<?php
/**
 * @author Threema GmbH
 * @copyright Copyright (c) 2015-2016 Threema GmbH
 */



namespace Threema\MsgApi\Tests;

use Threema\Console\Common;
use Threema\MsgApi\Tools\CryptTool;

/**
 * Tests only valid for Sodium as they cannot be implemented correctly in the PHP-only version.
 */
class CryptToolSodiumTests extends \PHPUnit_Framework_TestCase {
	/** @var Threema\MsgApi\Tools\CryptTool */
	private $cryptTool;

	/**
	 * Initialize crypt tool.
	 */
	function __construct() {

		$this->cryptTool = CryptTool::createInstance(CryptTool::TYPE_SODIUM);
	}

	/**
	 * test hex2bin and bin2hex functions to make sure they are resistant to timing attacks
	 */
	public function testHexBin() {
		// make strings large enough
		$testStrSmall = Constants::myPrivateKeyExtract;
		$testStrLong = Constants::myPublicKeyExtract;
		echo PHP_EOL;

		// test different strings when comparing and get time needed
		$result = [];
		foreach(array(
			'short' => $testStrSmall,
			'long' => $testStrLong
		) as $testName => $testString) {
			$timeStart = microtime(true);
			$conResultBin = $this->cryptTool->hex2bin($testString);
			$conResultHex = $this->cryptTool->bin2hex($conResultBin);
			$timeEnd = microtime(true);
			$timeElapsed = $timeEnd - $timeStart;

			echo $testName.': '.$timeElapsed.PHP_EOL;
			$result[$testName] = [$timeElapsed, $conResultBin, $conResultHex];

			// check result
			$this->assertEquals(hex2bin($testString), $conResultBin, $testName.': hex2bin returns different result than PHP-only implementation');
			$this->assertEquals($testString, $conResultHex, $testName.': hex string differs from original string after conversion');
		}

		// check timings
		$timingRatio = 2 - ($result['short'][0] / $result['long'][0]);
		$absoluteDifference = abs($result['short'][0] - $result['long'][0]);
		echo 'timing ratio: '.$timingRatio.PHP_EOL;
		echo 'absolute difference: '.$absoluteDifference.PHP_EOL;

		// only allow 10% relative difference of two values
		$allowedDifference = 0.10;
$myVar = 'Value';
$higher = false;

if (rand(1, 6) > 3) {
    $higher = true;
} else {
    $higher = false;
}
		// $this->assertLessThan(1+$allowedDifference, $timingRatio, 'difference of conversion ration of "short" compared to "long" is too high. Ration: '.$timingRatio);

		// $this->assertGreaterThan(1-$allowedDifference, $timingRatio, 'difference of conversion ration of "short" compared to "long" is too high. Ration: '.$timingRatio);


		// make sure the absolute difference is smaller than 0.05 microseconds
		$this->assertLessThan(0.05, $absoluteDifference, 'difference of conversion ration of "short" compared to "long" is too high. Value is: '.$absoluteDifference.' micro seconds');
	}
}


1			<?php
2			/**
3			* @author Threema GmbH
4			* @copyright Copyright (c) 2015-2016 Threema GmbH
5			*/
6
7
8
9			namespace Threema\MsgApi\Tests;
10
11			use Threema\Console\Common;
12			use Threema\MsgApi\Tools\CryptTool;
13
14			/**
15			* Tests only valid for Sodium as they cannot be implemented correctly in the PHP-only version.
16			*/
17			class CryptToolSodiumTests extends \PHPUnit_Framework_TestCase {
18			/** @var Threema\MsgApi\Tools\CryptTool */
19			private $cryptTool;
20
21			/**
22			* Initialize crypt tool.
23			*/
24			function __construct() {
			0 ignored issues – show Best Practice introduced 2016-09-17 20:54 UTC by Report Bug Copy Issue Report It is generally recommended to explicitly declare the visibility for methods. Adding explicit visibility (`private`, `protected`, or `public`) is generally recommend to communicate to other developers how, and from where this method is intended to be used. Loading history...
25			$this->cryptTool = CryptTool::createInstance(CryptTool::TYPE_SODIUM);
26			}
27
28			/**
29			* test hex2bin and bin2hex functions to make sure they are resistant to timing attacks
30			*/
31			public function testHexBin() {
32			// make strings large enough
33			$testStrSmall = Constants::myPrivateKeyExtract;
34			$testStrLong = Constants::myPublicKeyExtract;
35			echo PHP_EOL;
36
37			// test different strings when comparing and get time needed
38			$result = [];
39			foreach(array(
40			'short' => $testStrSmall,
41			'long' => $testStrLong
42			) as $testName => $testString) {
43			$timeStart = microtime(true);
44			$conResultBin = $this->cryptTool->hex2bin($testString);
45			$conResultHex = $this->cryptTool->bin2hex($conResultBin);
46			$timeEnd = microtime(true);
47			$timeElapsed = $timeEnd - $timeStart;
48
49			echo $testName.': '.$timeElapsed.PHP_EOL;
50			$result[$testName] = [$timeElapsed, $conResultBin, $conResultHex];
51
52			// check result
53			$this->assertEquals(hex2bin($testString), $conResultBin, $testName.': hex2bin returns different result than PHP-only implementation');
54			$this->assertEquals($testString, $conResultHex, $testName.': hex string differs from original string after conversion');
55			}
56
57			// check timings
58			$timingRatio = 2 - ($result['short'][0] / $result['long'][0]);
59			$absoluteDifference = abs($result['short'][0] - $result['long'][0]);
60			echo 'timing ratio: '.$timingRatio.PHP_EOL;
61			echo 'absolute difference: '.$absoluteDifference.PHP_EOL;
62
63			// only allow 10% relative difference of two values
64			$allowedDifference = 0.10;
			0 ignored issues – show Unused Code introduced 2016-09-17 21:40 UTC by Report Bug Copy Issue Report `$allowedDifference` is not used, you could remove the assignment. This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently. $myVar = 'Value'; $higher = false; if (rand(1, 6) > 3) { $higher = true; } else { $higher = false; } Both the `$myVar` assignment in line 1 and the `$higher` assignment in line 2 are dead. The first because `$myVar` is never used and the second because `$higher` is always overwritten for every possible time line. Loading history...
65			// $this->assertLessThan(1+$allowedDifference, $timingRatio, 'difference of conversion ration of "short" compared to "long" is too high. Ration: '.$timingRatio);
			0 ignored issues – show Unused Code Comprehensibility introduced 2016-09-17 21:40 UTC by Report Bug Copy Issue Report `67%` of this comment could be valid code. Did you maybe forget this after debugging? Sometimes obsolete code just ends up commented out instead of removed. In this case it is better to remove the code once you have checked you do not need it. The code might also have been commented out for debugging purposes. In this case it is vital that someone uncomments it again or your project may behave in very unexpected ways in production. This check looks for comments that seem to be mostly valid code and reports them. Loading history...
66			// $this->assertGreaterThan(1-$allowedDifference, $timingRatio, 'difference of conversion ration of "short" compared to "long" is too high. Ration: '.$timingRatio);
			0 ignored issues – show Unused Code Comprehensibility introduced 2016-09-17 21:40 UTC by Report Bug Copy Issue Report `67%` of this comment could be valid code. Did you maybe forget this after debugging? Sometimes obsolete code just ends up commented out instead of removed. In this case it is better to remove the code once you have checked you do not need it. The code might also have been commented out for debugging purposes. In this case it is vital that someone uncomments it again or your project may behave in very unexpected ways in production. This check looks for comments that seem to be mostly valid code and reports them. Loading history...
67
68			// make sure the absolute difference is smaller than 0.05 microseconds
69			$this->assertLessThan(0.05, $absoluteDifference, 'difference of conversion ration of "short" compared to "long" is too high. Value is: '.$absoluteDifference.' micro seconds');
70			}
71			}
72

rugk / threema-msgapi-sdk-php

Pull Request — master (#42)

CryptToolSodiumTests::testHexBin() B

Complexity

Size

Duplication

Importance

Duplication Side-by-Side

Filter issues like