Encrypter::validPayload() - Code Metrics - sgpopov/ironbox-client - Measure and Improve Code Quality continuously with Scrutinizer

Encrypter::validPayload() A
last analyzed 2019-07-23 18:40 UTC

↳ Parent: Encrypter

Complexity

Conditions	3
Paths	3

Size

Total Lines	5
Code Lines	3

Duplication

Lines	0
Ratio	0 %

Importance

Changes	1
Bugs	0	Features	0

Metric	Value
cc	3
eloc	3
c	1
b	0
f	0
nc	3
nop	1
dl	0
loc	5
rs	10

<?php

namespace SGP\IronBox\Encryption;

use SGP\IronBox\Exceptions\DecryptException;
use SGP\IronBox\Exceptions\EncryptException;
use RuntimeException;

class Encrypter
{
    /**
     * The encryption key.
     *
     * @var string
     */
    protected $key;

    /**
     * The algorithm used for encryption.
     *
     * @var string
     */
    protected $cipher;

    /**
     * The initialization vector to use.
     *
     * @var string
     */
    protected $iv;

    /**
     * Create a new encrypter instance.
     *
     * @param string $key
     * @param string $cipher
     * @param string $iv
     *
     * @return void
     *
     * @throws \RuntimeException
     */
    public function __construct($key, $cipher = 'AES-128-CBC', $iv = null)
    {
        $key = (string) $key;

        if (static::supported($key, $cipher)) {
            $this->key = $key;
            $this->cipher = $cipher;
            $this->iv = $iv;
        } else {
            throw new RuntimeException('The only supported ciphers are AES-128-CBC and AES-256-CBC');
        }
    }

    /**
     * Determine if the given key and cipher combination is valid.
     *
     * @param string $key
     * @param string $cipher
     *
     * @return bool
     */
    public static function supported($key, $cipher)
    {
        $length = mb_strlen($key, '8bit');

        return ($cipher === 'AES-128-CBC' && $length === 16) ||
            ($cipher === 'AES-256-CBC' && $length === 32);
    }

    /**
     * Create a new encryption key for the given cipher.
     *
     * @param string $cipher
     *
     * @return string
     * @throws \Exception
     */
    public static function generateKey($cipher)
    {
        return random_bytes($cipher === 'AES-128-CBC' ? 16 : 32);
    }

    /**
     * @param $value
     * @param bool $serialize
     *
     * @return string
     *
     * @throws \SGP\IronBox\Exceptions\EncryptException
     */
    public function encrypt($value, $serialize = true)
    {
        $iv = $this->iv ?? random_bytes(openssl_cipher_iv_length($this->cipher));

        // First we will encrypt the value using OpenSSL. After this is encrypted we
        // will proceed to calculating a MAC for the encrypted value so that this
        // value can be verified later as not having been changed by the users.
        $value = \openssl_encrypt(
            $serialize ? serialize($value) : $value,
            $this->cipher,
            $this->key,
            0,
            $iv
        );

        if ($value === false) {
            throw new EncryptException('Could not encrypt the data.');
        }

        // Once we get the encrypted value we'll go ahead and base64_encode the input
        // vector and create the MAC for the encrypted value so we can then verify
        // its authenticity. Then, we'll JSON the data into the "payload" array.
        $mac = $this->hash($iv = base64_encode($iv), $value);

        $json = json_encode(compact('iv', 'value', 'mac'));

        if (json_last_error() !== JSON_ERROR_NONE) {
            throw new EncryptException('Could not encrypt the data.');
        }

        return base64_encode($json);
    }

    /**
     * Encrypt a string without serialization.
     *
     * @param string $value
     *
     * @return string
     *
     * @throws \SGP\IronBox\Exceptions\EncryptException
     */
    public function encryptString($value)
    {
        return $this->encrypt($value, false);
    }

    /**
     * Decrypt the given value.
     *
     * @param mixed $payload
     * @param bool $unserialize
     *
     * @return mixed
     *
     * @throws \SGP\IronBox\Exceptions\DecryptException
     */
    public function decrypt($payload, $unserialize = true)
    {
        $payload = $this->getJsonPayload($payload);

        $iv = base64_decode($payload['iv']);

        // Here we will decrypt the value. If we are able to successfully decrypt it
        // we will then unserialize it and return it out to the caller. If we are
        // unable to decrypt this value we will throw out an exception message.
        $decrypted = \openssl_decrypt(
            $payload['value'],
            $this->cipher,
            $this->key,
            0,
            $iv
        );

        if ($decrypted === false) {
            throw new DecryptException('Could not decrypt the data.');
        }

        return $unserialize ? unserialize($decrypted) : $decrypted;
    }

    /**
     * Decrypt the given string without unserialization.
     *
     * @param string $payload
     *
     * @return string
     *
     * @throws \SGP\IronBox\Exceptions\DecryptException
     */
    public function decryptString($payload)
    {
        return $this->decrypt($payload, false);
    }

    /**
     * Get the encryption key.
     *
     * @return string
     */
    public function getKey()
    {
        return $this->key;
    }

    /**
     * Create a MAC for the given value.
     *
     * @param string $iv
     * @param mixed $value
     *
     * @return string
     */
    protected function hash($iv, $value)
    {
        return hash_hmac('sha256', $iv . $value, $this->key);
    }

    /**
     * Get the JSON array from the given payload.
     *
     * @param string $payload
     *
     * @return array
     *
     * @throws \SGP\IronBox\Exceptions\DecryptException
     */
    protected function getJsonPayload($payload)
    {
        $payload = json_decode(base64_decode($payload), true);

        // If the payload is not valid JSON or does not have the proper keys set we will
        // assume it is invalid and bail out of the routine since we will not be able
        // to decrypt the given value. We'll also check the MAC for this encryption.
        if (! $this->validPayload($payload)) {
            throw new DecryptException('The payload is invalid.');
        }

        if (! $this->validMac($payload)) {
            throw new DecryptException('The MAC is invalid.');
        }

        return $payload;
    }

    /**
     * Verify that the encryption payload is valid.
     *
     * @param mixed $payload
     *
     * @return bool
     */
    protected function validPayload($payload)
    {
        return is_array($payload) &&
            isset($payload['iv'], $payload['value'], $payload['mac']) &&
            strlen(base64_decode($payload['iv'], true)) === openssl_cipher_iv_length($this->cipher);
    }

    /**
     * Determine if the MAC for the given payload is valid.
     *
     * @param array $payload
     *
     * @return bool
     * @throws \Exception
     */
    protected function validMac(array $payload)
    {
        $calculated = $this->calculateMac($payload, $bytes = random_bytes(16));

        return hash_equals(
            hash_hmac('sha256', $payload['mac'], $bytes, true),
            $calculated
        );
    }

    /**
     * Calculate the hash of the given payload.
     *
     * @param array $payload
     * @param string $bytes
     *
     * @return string
     */
    protected function calculateMac($payload, $bytes)
    {
        return hash_hmac(
            'sha256',
            $this->hash($payload['iv'], $payload['value']),
            $bytes,
            true
        );
    }
}


1			<?php
2
3			namespace SGP\IronBox\Encryption;
4
5			use SGP\IronBox\Exceptions\DecryptException;
6			use SGP\IronBox\Exceptions\EncryptException;
7			use RuntimeException;
8
9			class Encrypter
10			{
11			/**
12			* The encryption key.
13			*
14			* @var string
15			*/
16			protected $key;
17
18			/**
19			* The algorithm used for encryption.
20			*
21			* @var string
22			*/
23			protected $cipher;
24
25			/**
26			* The initialization vector to use.
27			*
28			* @var string
29			*/
30			protected $iv;
31
32			/**
33			* Create a new encrypter instance.
34			*
35			* @param string $key
36			* @param string $cipher
37			* @param string $iv
38			*
39			* @return void
40			*
41			* @throws \RuntimeException
42			*/
43			public function __construct($key, $cipher = 'AES-128-CBC', $iv = null)
44			{
45			$key = (string) $key;
46
47			if (static::supported($key, $cipher)) {
48			$this->key = $key;
49			$this->cipher = $cipher;
50			$this->iv = $iv;
51			} else {
52			throw new RuntimeException('The only supported ciphers are AES-128-CBC and AES-256-CBC');
53			}
54			}
55
56			/**
57			* Determine if the given key and cipher combination is valid.
58			*
59			* @param string $key
60			* @param string $cipher
61			*
62			* @return bool
63			*/
64			public static function supported($key, $cipher)
65			{
66			$length = mb_strlen($key, '8bit');
67
68			return ($cipher === 'AES-128-CBC' && $length === 16) \|\|
69			($cipher === 'AES-256-CBC' && $length === 32);
70			}
71
72			/**
73			* Create a new encryption key for the given cipher.
74			*
75			* @param string $cipher
76			*
77			* @return string
78			* @throws \Exception
79			*/
80			public static function generateKey($cipher)
81			{
82			return random_bytes($cipher === 'AES-128-CBC' ? 16 : 32);
83			}
84
85			/**
86			* @param $value
87			* @param bool $serialize
88			*
89			* @return string
90			*
91			* @throws \SGP\IronBox\Exceptions\EncryptException
92			*/
93			public function encrypt($value, $serialize = true)
94			{
95			$iv = $this->iv ?? random_bytes(openssl_cipher_iv_length($this->cipher));
96
97			// First we will encrypt the value using OpenSSL. After this is encrypted we
98			// will proceed to calculating a MAC for the encrypted value so that this
99			// value can be verified later as not having been changed by the users.
100			$value = \openssl_encrypt(
101			$serialize ? serialize($value) : $value,
102			$this->cipher,
103			$this->key,
104			0,
105			$iv
106			);
107
108			if ($value === false) {
109			throw new EncryptException('Could not encrypt the data.');
110			}
111
112			// Once we get the encrypted value we'll go ahead and base64_encode the input
113			// vector and create the MAC for the encrypted value so we can then verify
114			// its authenticity. Then, we'll JSON the data into the "payload" array.
115			$mac = $this->hash($iv = base64_encode($iv), $value);
116
117			$json = json_encode(compact('iv', 'value', 'mac'));
118
119			if (json_last_error() !== JSON_ERROR_NONE) {
120			throw new EncryptException('Could not encrypt the data.');
121			}
122
123			return base64_encode($json);
124			}
125
126			/**
127			* Encrypt a string without serialization.
128			*
129			* @param string $value
130			*
131			* @return string
132			*
133			* @throws \SGP\IronBox\Exceptions\EncryptException
134			*/
135			public function encryptString($value)
136			{
137			return $this->encrypt($value, false);
138			}
139
140			/**
141			* Decrypt the given value.
142			*
143			* @param mixed $payload
144			* @param bool $unserialize
145			*
146			* @return mixed
147			*
148			* @throws \SGP\IronBox\Exceptions\DecryptException
149			*/
150			public function decrypt($payload, $unserialize = true)
151			{
152			$payload = $this->getJsonPayload($payload);
153
154			$iv = base64_decode($payload['iv']);
155
156			// Here we will decrypt the value. If we are able to successfully decrypt it
157			// we will then unserialize it and return it out to the caller. If we are
158			// unable to decrypt this value we will throw out an exception message.
159			$decrypted = \openssl_decrypt(
160			$payload['value'],
161			$this->cipher,
162			$this->key,
163			0,
164			$iv
165			);
166
167			if ($decrypted === false) {
168			throw new DecryptException('Could not decrypt the data.');
169			}
170
171			return $unserialize ? unserialize($decrypted) : $decrypted;
172			}
173
174			/**
175			* Decrypt the given string without unserialization.
176			*
177			* @param string $payload
178			*
179			* @return string
180			*
181			* @throws \SGP\IronBox\Exceptions\DecryptException
182			*/
183			public function decryptString($payload)
184			{
185			return $this->decrypt($payload, false);
186			}
187
188			/**
189			* Get the encryption key.
190			*
191			* @return string
192			*/
193			public function getKey()
194			{
195			return $this->key;
196			}
197
198			/**
199			* Create a MAC for the given value.
200			*
201			* @param string $iv
202			* @param mixed $value
203			*
204			* @return string
205			*/
206			protected function hash($iv, $value)
207			{
208			return hash_hmac('sha256', $iv . $value, $this->key);
209			}
210
211			/**
212			* Get the JSON array from the given payload.
213			*
214			* @param string $payload
215			*
216			* @return array
217			*
218			* @throws \SGP\IronBox\Exceptions\DecryptException
219			*/
220			protected function getJsonPayload($payload)
221			{
222			$payload = json_decode(base64_decode($payload), true);
223
224			// If the payload is not valid JSON or does not have the proper keys set we will
225			// assume it is invalid and bail out of the routine since we will not be able
226			// to decrypt the given value. We'll also check the MAC for this encryption.
227			if (! $this->validPayload($payload)) {
228			throw new DecryptException('The payload is invalid.');
229			}
230
231			if (! $this->validMac($payload)) {
232			throw new DecryptException('The MAC is invalid.');
233			}
234
235			return $payload;
236			}
237
238			/**
239			* Verify that the encryption payload is valid.
240			*
241			* @param mixed $payload
242			*
243			* @return bool
244			*/
245			protected function validPayload($payload)
246			{
247			return is_array($payload) &&
248			isset($payload['iv'], $payload['value'], $payload['mac']) &&
249			strlen(base64_decode($payload['iv'], true)) === openssl_cipher_iv_length($this->cipher);
250			}
251
252			/**
253			* Determine if the MAC for the given payload is valid.
254			*
255			* @param array $payload
256			*
257			* @return bool
258			* @throws \Exception
259			*/
260			protected function validMac(array $payload)
261			{
262			$calculated = $this->calculateMac($payload, $bytes = random_bytes(16));
263
264			return hash_equals(
265			hash_hmac('sha256', $payload['mac'], $bytes, true),
266			$calculated
267			);
268			}
269
270			/**
271			* Calculate the hash of the given payload.
272			*
273			* @param array $payload
274			* @param string $bytes
275			*
276			* @return string
277			*/
278			protected function calculateMac($payload, $bytes)
279			{
280			return hash_hmac(
281			'sha256',
282			$this->hash($payload['iv'], $payload['value']),
283			$bytes,
284			true
285			);
286			}
287			}
288

sgpopov / ironbox-client

Encrypter::validPayload() A last analyzed 2019-07-23 18:40 UTC

Complexity

Size

Duplication

Importance

Duplication Side-by-Side

Filter issues like

Encrypter::validPayload() A
last analyzed 2019-07-23 18:40 UTC