@@ -20,362 +20,362 @@ |
||
| 20 | 20 | */ |
| 21 | 21 | class JWE |
| 22 | 22 | { |
| 23 | - /** |
|
| 24 | - * Protected header. |
|
| 25 | - * |
|
| 26 | - * @var Header |
|
| 27 | - */ |
|
| 28 | - protected $_protectedHeader; |
|
| 23 | + /** |
|
| 24 | + * Protected header. |
|
| 25 | + * |
|
| 26 | + * @var Header |
|
| 27 | + */ |
|
| 28 | + protected $_protectedHeader; |
|
| 29 | 29 | |
| 30 | - /** |
|
| 31 | - * Encrypted key. |
|
| 32 | - * |
|
| 33 | - * @var string |
|
| 34 | - */ |
|
| 35 | - protected $_encryptedKey; |
|
| 30 | + /** |
|
| 31 | + * Encrypted key. |
|
| 32 | + * |
|
| 33 | + * @var string |
|
| 34 | + */ |
|
| 35 | + protected $_encryptedKey; |
|
| 36 | 36 | |
| 37 | - /** |
|
| 38 | - * Initialization vector. |
|
| 39 | - * |
|
| 40 | - * @var string |
|
| 41 | - */ |
|
| 42 | - protected $_iv; |
|
| 37 | + /** |
|
| 38 | + * Initialization vector. |
|
| 39 | + * |
|
| 40 | + * @var string |
|
| 41 | + */ |
|
| 42 | + protected $_iv; |
|
| 43 | 43 | |
| 44 | - /** |
|
| 45 | - * Additional authenticated data. |
|
| 46 | - * |
|
| 47 | - * @var null|string |
|
| 48 | - */ |
|
| 49 | - protected $_aad; |
|
| 44 | + /** |
|
| 45 | + * Additional authenticated data. |
|
| 46 | + * |
|
| 47 | + * @var null|string |
|
| 48 | + */ |
|
| 49 | + protected $_aad; |
|
| 50 | 50 | |
| 51 | - /** |
|
| 52 | - * Ciphertext. |
|
| 53 | - * |
|
| 54 | - * @var string |
|
| 55 | - */ |
|
| 56 | - protected $_ciphertext; |
|
| 51 | + /** |
|
| 52 | + * Ciphertext. |
|
| 53 | + * |
|
| 54 | + * @var string |
|
| 55 | + */ |
|
| 56 | + protected $_ciphertext; |
|
| 57 | 57 | |
| 58 | - /** |
|
| 59 | - * Authentication tag. |
|
| 60 | - * |
|
| 61 | - * @var string |
|
| 62 | - */ |
|
| 63 | - protected $_authenticationTag; |
|
| 58 | + /** |
|
| 59 | + * Authentication tag. |
|
| 60 | + * |
|
| 61 | + * @var string |
|
| 62 | + */ |
|
| 63 | + protected $_authenticationTag; |
|
| 64 | 64 | |
| 65 | - /** |
|
| 66 | - * Constructor. |
|
| 67 | - * |
|
| 68 | - * @param Header $protected_header JWE Protected Header |
|
| 69 | - * @param string $encrypted_key Encrypted key |
|
| 70 | - * @param string $iv Initialization vector |
|
| 71 | - * @param string $ciphertext Ciphertext |
|
| 72 | - * @param string $auth_tag Authentication tag |
|
| 73 | - * @param null|string $aad Additional authenticated data |
|
| 74 | - */ |
|
| 75 | - public function __construct(Header $protected_header, string $encrypted_key, |
|
| 76 | - string $iv, string $ciphertext, string $auth_tag, ?string $aad = null) |
|
| 77 | - { |
|
| 78 | - $this->_protectedHeader = $protected_header; |
|
| 79 | - $this->_encryptedKey = $encrypted_key; |
|
| 80 | - $this->_iv = $iv; |
|
| 81 | - $this->_aad = $aad; |
|
| 82 | - $this->_ciphertext = $ciphertext; |
|
| 83 | - $this->_authenticationTag = $auth_tag; |
|
| 84 | - } |
|
| 65 | + /** |
|
| 66 | + * Constructor. |
|
| 67 | + * |
|
| 68 | + * @param Header $protected_header JWE Protected Header |
|
| 69 | + * @param string $encrypted_key Encrypted key |
|
| 70 | + * @param string $iv Initialization vector |
|
| 71 | + * @param string $ciphertext Ciphertext |
|
| 72 | + * @param string $auth_tag Authentication tag |
|
| 73 | + * @param null|string $aad Additional authenticated data |
|
| 74 | + */ |
|
| 75 | + public function __construct(Header $protected_header, string $encrypted_key, |
|
| 76 | + string $iv, string $ciphertext, string $auth_tag, ?string $aad = null) |
|
| 77 | + { |
|
| 78 | + $this->_protectedHeader = $protected_header; |
|
| 79 | + $this->_encryptedKey = $encrypted_key; |
|
| 80 | + $this->_iv = $iv; |
|
| 81 | + $this->_aad = $aad; |
|
| 82 | + $this->_ciphertext = $ciphertext; |
|
| 83 | + $this->_authenticationTag = $auth_tag; |
|
| 84 | + } |
|
| 85 | 85 | |
| 86 | - /** |
|
| 87 | - * Convert JWE to string. |
|
| 88 | - * |
|
| 89 | - * @return string |
|
| 90 | - */ |
|
| 91 | - public function __toString(): string |
|
| 92 | - { |
|
| 93 | - return $this->toCompact(); |
|
| 94 | - } |
|
| 86 | + /** |
|
| 87 | + * Convert JWE to string. |
|
| 88 | + * |
|
| 89 | + * @return string |
|
| 90 | + */ |
|
| 91 | + public function __toString(): string |
|
| 92 | + { |
|
| 93 | + return $this->toCompact(); |
|
| 94 | + } |
|
| 95 | 95 | |
| 96 | - /** |
|
| 97 | - * Initialize from compact serialization. |
|
| 98 | - * |
|
| 99 | - * @param string $data |
|
| 100 | - * |
|
| 101 | - * @return self |
|
| 102 | - */ |
|
| 103 | - public static function fromCompact(string $data): self |
|
| 104 | - { |
|
| 105 | - return self::fromParts(explode('.', $data)); |
|
| 106 | - } |
|
| 96 | + /** |
|
| 97 | + * Initialize from compact serialization. |
|
| 98 | + * |
|
| 99 | + * @param string $data |
|
| 100 | + * |
|
| 101 | + * @return self |
|
| 102 | + */ |
|
| 103 | + public static function fromCompact(string $data): self |
|
| 104 | + { |
|
| 105 | + return self::fromParts(explode('.', $data)); |
|
| 106 | + } |
|
| 107 | 107 | |
| 108 | - /** |
|
| 109 | - * Initialize from parts of compact serialization. |
|
| 110 | - * |
|
| 111 | - * @param array $parts |
|
| 112 | - * |
|
| 113 | - * @throws \UnexpectedValueException |
|
| 114 | - * |
|
| 115 | - * @return self |
|
| 116 | - */ |
|
| 117 | - public static function fromParts(array $parts): self |
|
| 118 | - { |
|
| 119 | - if (5 !== count($parts)) { |
|
| 120 | - throw new \UnexpectedValueException( |
|
| 121 | - 'Invalid JWE compact serialization.'); |
|
| 122 | - } |
|
| 123 | - $header = Header::fromJSON(Base64::urlDecode($parts[0])); |
|
| 124 | - $encrypted_key = Base64::urlDecode($parts[1]); |
|
| 125 | - $iv = Base64::urlDecode($parts[2]); |
|
| 126 | - $ciphertext = Base64::urlDecode($parts[3]); |
|
| 127 | - $auth_tag = Base64::urlDecode($parts[4]); |
|
| 128 | - return new self($header, $encrypted_key, $iv, $ciphertext, $auth_tag); |
|
| 129 | - } |
|
| 108 | + /** |
|
| 109 | + * Initialize from parts of compact serialization. |
|
| 110 | + * |
|
| 111 | + * @param array $parts |
|
| 112 | + * |
|
| 113 | + * @throws \UnexpectedValueException |
|
| 114 | + * |
|
| 115 | + * @return self |
|
| 116 | + */ |
|
| 117 | + public static function fromParts(array $parts): self |
|
| 118 | + { |
|
| 119 | + if (5 !== count($parts)) { |
|
| 120 | + throw new \UnexpectedValueException( |
|
| 121 | + 'Invalid JWE compact serialization.'); |
|
| 122 | + } |
|
| 123 | + $header = Header::fromJSON(Base64::urlDecode($parts[0])); |
|
| 124 | + $encrypted_key = Base64::urlDecode($parts[1]); |
|
| 125 | + $iv = Base64::urlDecode($parts[2]); |
|
| 126 | + $ciphertext = Base64::urlDecode($parts[3]); |
|
| 127 | + $auth_tag = Base64::urlDecode($parts[4]); |
|
| 128 | + return new self($header, $encrypted_key, $iv, $ciphertext, $auth_tag); |
|
| 129 | + } |
|
| 130 | 130 | |
| 131 | - /** |
|
| 132 | - * Initialize by encrypting the given payload. |
|
| 133 | - * |
|
| 134 | - * @param string $payload Payload |
|
| 135 | - * @param KeyManagementAlgorithm $key_algo Key management algorithm |
|
| 136 | - * @param ContentEncryptionAlgorithm $enc_algo Content encryption algorithm |
|
| 137 | - * @param null|CompressionAlgorithm $zip_algo Optional compression algorithm |
|
| 138 | - * @param null|Header $header Optional desired header. |
|
| 139 | - * Algorithm specific parameters are |
|
| 140 | - * automatically added. |
|
| 141 | - * @param null|string $cek Optional content encryption key. |
|
| 142 | - * Randomly enerated if not set. |
|
| 143 | - * @param null|string $iv Optional initialization vector. |
|
| 144 | - * Randomly generated if not set. |
|
| 145 | - * |
|
| 146 | - * @throws \RuntimeException If encrypt fails |
|
| 147 | - * |
|
| 148 | - * @return self |
|
| 149 | - */ |
|
| 150 | - public static function encrypt(string $payload, |
|
| 151 | - KeyManagementAlgorithm $key_algo, ContentEncryptionAlgorithm $enc_algo, |
|
| 152 | - ?CompressionAlgorithm $zip_algo = null, ?Header $header = null, |
|
| 153 | - ?string $cek = null, ?string $iv = null): self |
|
| 154 | - { |
|
| 155 | - // if header was not given, initialize empty |
|
| 156 | - if (!isset($header)) { |
|
| 157 | - $header = new Header(); |
|
| 158 | - } |
|
| 159 | - // generate random CEK |
|
| 160 | - if (!isset($cek)) { |
|
| 161 | - $cek = $key_algo->cekForEncryption($enc_algo->keySize()); |
|
| 162 | - } |
|
| 163 | - // generate random IV |
|
| 164 | - if (!isset($iv)) { |
|
| 165 | - $iv = openssl_random_pseudo_bytes($enc_algo->ivSize()); |
|
| 166 | - } |
|
| 167 | - // compress |
|
| 168 | - if (isset($zip_algo)) { |
|
| 169 | - $payload = $zip_algo->compress($payload); |
|
| 170 | - $header = $header->withParameters(...$zip_algo->headerParameters()); |
|
| 171 | - } |
|
| 172 | - return self::_encryptContent($payload, $cek, $iv, |
|
| 173 | - $key_algo, $enc_algo, $header); |
|
| 174 | - } |
|
| 131 | + /** |
|
| 132 | + * Initialize by encrypting the given payload. |
|
| 133 | + * |
|
| 134 | + * @param string $payload Payload |
|
| 135 | + * @param KeyManagementAlgorithm $key_algo Key management algorithm |
|
| 136 | + * @param ContentEncryptionAlgorithm $enc_algo Content encryption algorithm |
|
| 137 | + * @param null|CompressionAlgorithm $zip_algo Optional compression algorithm |
|
| 138 | + * @param null|Header $header Optional desired header. |
|
| 139 | + * Algorithm specific parameters are |
|
| 140 | + * automatically added. |
|
| 141 | + * @param null|string $cek Optional content encryption key. |
|
| 142 | + * Randomly enerated if not set. |
|
| 143 | + * @param null|string $iv Optional initialization vector. |
|
| 144 | + * Randomly generated if not set. |
|
| 145 | + * |
|
| 146 | + * @throws \RuntimeException If encrypt fails |
|
| 147 | + * |
|
| 148 | + * @return self |
|
| 149 | + */ |
|
| 150 | + public static function encrypt(string $payload, |
|
| 151 | + KeyManagementAlgorithm $key_algo, ContentEncryptionAlgorithm $enc_algo, |
|
| 152 | + ?CompressionAlgorithm $zip_algo = null, ?Header $header = null, |
|
| 153 | + ?string $cek = null, ?string $iv = null): self |
|
| 154 | + { |
|
| 155 | + // if header was not given, initialize empty |
|
| 156 | + if (!isset($header)) { |
|
| 157 | + $header = new Header(); |
|
| 158 | + } |
|
| 159 | + // generate random CEK |
|
| 160 | + if (!isset($cek)) { |
|
| 161 | + $cek = $key_algo->cekForEncryption($enc_algo->keySize()); |
|
| 162 | + } |
|
| 163 | + // generate random IV |
|
| 164 | + if (!isset($iv)) { |
|
| 165 | + $iv = openssl_random_pseudo_bytes($enc_algo->ivSize()); |
|
| 166 | + } |
|
| 167 | + // compress |
|
| 168 | + if (isset($zip_algo)) { |
|
| 169 | + $payload = $zip_algo->compress($payload); |
|
| 170 | + $header = $header->withParameters(...$zip_algo->headerParameters()); |
|
| 171 | + } |
|
| 172 | + return self::_encryptContent($payload, $cek, $iv, |
|
| 173 | + $key_algo, $enc_algo, $header); |
|
| 174 | + } |
|
| 175 | 175 | |
| 176 | - /** |
|
| 177 | - * Decrypt the content using explicit algorithms. |
|
| 178 | - * |
|
| 179 | - * @param KeyManagementAlgorithm $key_algo Key management algorithm |
|
| 180 | - * @param ContentEncryptionAlgorithm $enc_algo Content encryption algorithm |
|
| 181 | - * |
|
| 182 | - * @throws \RuntimeException If decrypt fails |
|
| 183 | - * |
|
| 184 | - * @return string Plaintext payload |
|
| 185 | - */ |
|
| 186 | - public function decrypt(KeyManagementAlgorithm $key_algo, |
|
| 187 | - ContentEncryptionAlgorithm $enc_algo): string |
|
| 188 | - { |
|
| 189 | - // check that key management algorithm matches |
|
| 190 | - if ($key_algo->algorithmParamValue() !== $this->algorithmName()) { |
|
| 191 | - throw new \UnexpectedValueException( |
|
| 192 | - 'Invalid key management algorithm.'); |
|
| 193 | - } |
|
| 194 | - // check that encryption algorithm matches |
|
| 195 | - if ($enc_algo->encryptionAlgorithmParamValue() !== $this->encryptionAlgorithmName()) { |
|
| 196 | - throw new \UnexpectedValueException('Invalid encryption algorithm.'); |
|
| 197 | - } |
|
| 198 | - $header = $this->header(); |
|
| 199 | - // decrypt content encryption key |
|
| 200 | - $cek = $key_algo->decrypt($this->_encryptedKey, $header); |
|
| 201 | - // decrypt payload |
|
| 202 | - $aad = Base64::urlEncode($this->_protectedHeader->toJSON()); |
|
| 203 | - $payload = $enc_algo->decrypt($this->_ciphertext, $cek, |
|
| 204 | - $this->_iv, $aad, $this->_authenticationTag); |
|
| 205 | - // decompress |
|
| 206 | - if ($header->hasCompressionAlgorithm()) { |
|
| 207 | - $payload = CompressionFactory::algoByHeader($header)->decompress($payload); |
|
| 208 | - } |
|
| 209 | - return $payload; |
|
| 210 | - } |
|
| 176 | + /** |
|
| 177 | + * Decrypt the content using explicit algorithms. |
|
| 178 | + * |
|
| 179 | + * @param KeyManagementAlgorithm $key_algo Key management algorithm |
|
| 180 | + * @param ContentEncryptionAlgorithm $enc_algo Content encryption algorithm |
|
| 181 | + * |
|
| 182 | + * @throws \RuntimeException If decrypt fails |
|
| 183 | + * |
|
| 184 | + * @return string Plaintext payload |
|
| 185 | + */ |
|
| 186 | + public function decrypt(KeyManagementAlgorithm $key_algo, |
|
| 187 | + ContentEncryptionAlgorithm $enc_algo): string |
|
| 188 | + { |
|
| 189 | + // check that key management algorithm matches |
|
| 190 | + if ($key_algo->algorithmParamValue() !== $this->algorithmName()) { |
|
| 191 | + throw new \UnexpectedValueException( |
|
| 192 | + 'Invalid key management algorithm.'); |
|
| 193 | + } |
|
| 194 | + // check that encryption algorithm matches |
|
| 195 | + if ($enc_algo->encryptionAlgorithmParamValue() !== $this->encryptionAlgorithmName()) { |
|
| 196 | + throw new \UnexpectedValueException('Invalid encryption algorithm.'); |
|
| 197 | + } |
|
| 198 | + $header = $this->header(); |
|
| 199 | + // decrypt content encryption key |
|
| 200 | + $cek = $key_algo->decrypt($this->_encryptedKey, $header); |
|
| 201 | + // decrypt payload |
|
| 202 | + $aad = Base64::urlEncode($this->_protectedHeader->toJSON()); |
|
| 203 | + $payload = $enc_algo->decrypt($this->_ciphertext, $cek, |
|
| 204 | + $this->_iv, $aad, $this->_authenticationTag); |
|
| 205 | + // decompress |
|
| 206 | + if ($header->hasCompressionAlgorithm()) { |
|
| 207 | + $payload = CompressionFactory::algoByHeader($header)->decompress($payload); |
|
| 208 | + } |
|
| 209 | + return $payload; |
|
| 210 | + } |
|
| 211 | 211 | |
| 212 | - /** |
|
| 213 | - * Decrypt content using given JWK. |
|
| 214 | - * |
|
| 215 | - * Key management and content encryption algorithms are determined from the |
|
| 216 | - * header. |
|
| 217 | - * |
|
| 218 | - * @param JWK $jwk JSON Web Key |
|
| 219 | - * |
|
| 220 | - * @throws \RuntimeException If algorithm initialization fails |
|
| 221 | - * |
|
| 222 | - * @return string Plaintext payload |
|
| 223 | - */ |
|
| 224 | - public function decryptWithJWK(JWK $jwk): string |
|
| 225 | - { |
|
| 226 | - $header = $this->header(); |
|
| 227 | - $key_algo = KeyManagementAlgorithm::fromJWK($jwk, $header); |
|
| 228 | - $enc_algo = EncryptionAlgorithmFactory::algoByHeader($header); |
|
| 229 | - return $this->decrypt($key_algo, $enc_algo); |
|
| 230 | - } |
|
| 212 | + /** |
|
| 213 | + * Decrypt content using given JWK. |
|
| 214 | + * |
|
| 215 | + * Key management and content encryption algorithms are determined from the |
|
| 216 | + * header. |
|
| 217 | + * |
|
| 218 | + * @param JWK $jwk JSON Web Key |
|
| 219 | + * |
|
| 220 | + * @throws \RuntimeException If algorithm initialization fails |
|
| 221 | + * |
|
| 222 | + * @return string Plaintext payload |
|
| 223 | + */ |
|
| 224 | + public function decryptWithJWK(JWK $jwk): string |
|
| 225 | + { |
|
| 226 | + $header = $this->header(); |
|
| 227 | + $key_algo = KeyManagementAlgorithm::fromJWK($jwk, $header); |
|
| 228 | + $enc_algo = EncryptionAlgorithmFactory::algoByHeader($header); |
|
| 229 | + return $this->decrypt($key_algo, $enc_algo); |
|
| 230 | + } |
|
| 231 | 231 | |
| 232 | - /** |
|
| 233 | - * Decrypt content using a key from the given JWK set. |
|
| 234 | - * |
|
| 235 | - * Correct key shall be sought by the key ID indicated by the header. |
|
| 236 | - * |
|
| 237 | - * @param JWKSet $set Set of JSON Web Keys |
|
| 238 | - * |
|
| 239 | - * @throws \RuntimeException If algorithm initialization fails |
|
| 240 | - * |
|
| 241 | - * @return string Plaintext payload |
|
| 242 | - */ |
|
| 243 | - public function decryptWithJWKSet(JWKSet $set): string |
|
| 244 | - { |
|
| 245 | - if (!count($set)) { |
|
| 246 | - throw new \RuntimeException('No keys.'); |
|
| 247 | - } |
|
| 248 | - $header = $this->header(); |
|
| 249 | - $factory = new KeyAlgorithmFactory($header); |
|
| 250 | - $key_algo = $factory->algoByKeys($set); |
|
| 251 | - $enc_algo = EncryptionAlgorithmFactory::algoByHeader($header); |
|
| 252 | - return $this->decrypt($key_algo, $enc_algo); |
|
| 253 | - } |
|
| 232 | + /** |
|
| 233 | + * Decrypt content using a key from the given JWK set. |
|
| 234 | + * |
|
| 235 | + * Correct key shall be sought by the key ID indicated by the header. |
|
| 236 | + * |
|
| 237 | + * @param JWKSet $set Set of JSON Web Keys |
|
| 238 | + * |
|
| 239 | + * @throws \RuntimeException If algorithm initialization fails |
|
| 240 | + * |
|
| 241 | + * @return string Plaintext payload |
|
| 242 | + */ |
|
| 243 | + public function decryptWithJWKSet(JWKSet $set): string |
|
| 244 | + { |
|
| 245 | + if (!count($set)) { |
|
| 246 | + throw new \RuntimeException('No keys.'); |
|
| 247 | + } |
|
| 248 | + $header = $this->header(); |
|
| 249 | + $factory = new KeyAlgorithmFactory($header); |
|
| 250 | + $key_algo = $factory->algoByKeys($set); |
|
| 251 | + $enc_algo = EncryptionAlgorithmFactory::algoByHeader($header); |
|
| 252 | + return $this->decrypt($key_algo, $enc_algo); |
|
| 253 | + } |
|
| 254 | 254 | |
| 255 | - /** |
|
| 256 | - * Get JOSE header. |
|
| 257 | - * |
|
| 258 | - * @return JOSE |
|
| 259 | - */ |
|
| 260 | - public function header(): JOSE |
|
| 261 | - { |
|
| 262 | - return new JOSE($this->_protectedHeader); |
|
| 263 | - } |
|
| 255 | + /** |
|
| 256 | + * Get JOSE header. |
|
| 257 | + * |
|
| 258 | + * @return JOSE |
|
| 259 | + */ |
|
| 260 | + public function header(): JOSE |
|
| 261 | + { |
|
| 262 | + return new JOSE($this->_protectedHeader); |
|
| 263 | + } |
|
| 264 | 264 | |
| 265 | - /** |
|
| 266 | - * Get the name of the key management algorithm. |
|
| 267 | - * |
|
| 268 | - * @return string |
|
| 269 | - */ |
|
| 270 | - public function algorithmName(): string |
|
| 271 | - { |
|
| 272 | - return $this->header()->algorithm()->value(); |
|
| 273 | - } |
|
| 265 | + /** |
|
| 266 | + * Get the name of the key management algorithm. |
|
| 267 | + * |
|
| 268 | + * @return string |
|
| 269 | + */ |
|
| 270 | + public function algorithmName(): string |
|
| 271 | + { |
|
| 272 | + return $this->header()->algorithm()->value(); |
|
| 273 | + } |
|
| 274 | 274 | |
| 275 | - /** |
|
| 276 | - * Get the name of the encryption algorithm. |
|
| 277 | - * |
|
| 278 | - * @return string |
|
| 279 | - */ |
|
| 280 | - public function encryptionAlgorithmName(): string |
|
| 281 | - { |
|
| 282 | - return $this->header()->encryptionAlgorithm()->value(); |
|
| 283 | - } |
|
| 275 | + /** |
|
| 276 | + * Get the name of the encryption algorithm. |
|
| 277 | + * |
|
| 278 | + * @return string |
|
| 279 | + */ |
|
| 280 | + public function encryptionAlgorithmName(): string |
|
| 281 | + { |
|
| 282 | + return $this->header()->encryptionAlgorithm()->value(); |
|
| 283 | + } |
|
| 284 | 284 | |
| 285 | - /** |
|
| 286 | - * Get encrypted CEK. |
|
| 287 | - * |
|
| 288 | - * @return string |
|
| 289 | - */ |
|
| 290 | - public function encryptedKey(): string |
|
| 291 | - { |
|
| 292 | - return $this->_encryptedKey; |
|
| 293 | - } |
|
| 285 | + /** |
|
| 286 | + * Get encrypted CEK. |
|
| 287 | + * |
|
| 288 | + * @return string |
|
| 289 | + */ |
|
| 290 | + public function encryptedKey(): string |
|
| 291 | + { |
|
| 292 | + return $this->_encryptedKey; |
|
| 293 | + } |
|
| 294 | 294 | |
| 295 | - /** |
|
| 296 | - * Get initialization vector. |
|
| 297 | - * |
|
| 298 | - * @return string |
|
| 299 | - */ |
|
| 300 | - public function initializationVector(): string |
|
| 301 | - { |
|
| 302 | - return $this->_iv; |
|
| 303 | - } |
|
| 295 | + /** |
|
| 296 | + * Get initialization vector. |
|
| 297 | + * |
|
| 298 | + * @return string |
|
| 299 | + */ |
|
| 300 | + public function initializationVector(): string |
|
| 301 | + { |
|
| 302 | + return $this->_iv; |
|
| 303 | + } |
|
| 304 | 304 | |
| 305 | - /** |
|
| 306 | - * Get ciphertext. |
|
| 307 | - * |
|
| 308 | - * @return string |
|
| 309 | - */ |
|
| 310 | - public function ciphertext(): string |
|
| 311 | - { |
|
| 312 | - return $this->_ciphertext; |
|
| 313 | - } |
|
| 305 | + /** |
|
| 306 | + * Get ciphertext. |
|
| 307 | + * |
|
| 308 | + * @return string |
|
| 309 | + */ |
|
| 310 | + public function ciphertext(): string |
|
| 311 | + { |
|
| 312 | + return $this->_ciphertext; |
|
| 313 | + } |
|
| 314 | 314 | |
| 315 | - /** |
|
| 316 | - * Get authentication tag. |
|
| 317 | - * |
|
| 318 | - * @return string |
|
| 319 | - */ |
|
| 320 | - public function authenticationTag(): string |
|
| 321 | - { |
|
| 322 | - return $this->_authenticationTag; |
|
| 323 | - } |
|
| 315 | + /** |
|
| 316 | + * Get authentication tag. |
|
| 317 | + * |
|
| 318 | + * @return string |
|
| 319 | + */ |
|
| 320 | + public function authenticationTag(): string |
|
| 321 | + { |
|
| 322 | + return $this->_authenticationTag; |
|
| 323 | + } |
|
| 324 | 324 | |
| 325 | - /** |
|
| 326 | - * Convert to compact serialization. |
|
| 327 | - * |
|
| 328 | - * @return string |
|
| 329 | - */ |
|
| 330 | - public function toCompact(): string |
|
| 331 | - { |
|
| 332 | - return Base64::urlEncode($this->_protectedHeader->toJSON()) . '.' . |
|
| 333 | - Base64::urlEncode($this->_encryptedKey) . '.' . |
|
| 334 | - Base64::urlEncode($this->_iv) . '.' . |
|
| 335 | - Base64::urlEncode($this->_ciphertext) . '.' . |
|
| 336 | - Base64::urlEncode($this->_authenticationTag); |
|
| 337 | - } |
|
| 325 | + /** |
|
| 326 | + * Convert to compact serialization. |
|
| 327 | + * |
|
| 328 | + * @return string |
|
| 329 | + */ |
|
| 330 | + public function toCompact(): string |
|
| 331 | + { |
|
| 332 | + return Base64::urlEncode($this->_protectedHeader->toJSON()) . '.' . |
|
| 333 | + Base64::urlEncode($this->_encryptedKey) . '.' . |
|
| 334 | + Base64::urlEncode($this->_iv) . '.' . |
|
| 335 | + Base64::urlEncode($this->_ciphertext) . '.' . |
|
| 336 | + Base64::urlEncode($this->_authenticationTag); |
|
| 337 | + } |
|
| 338 | 338 | |
| 339 | - /** |
|
| 340 | - * Encrypt content with explicit parameters. |
|
| 341 | - * |
|
| 342 | - * @param string $plaintext Plaintext content to encrypt |
|
| 343 | - * @param string $cek Content encryption key |
|
| 344 | - * @param string $iv Initialization vector |
|
| 345 | - * @param KeyManagementAlgorithm $key_algo Key management algorithm |
|
| 346 | - * @param ContentEncryptionAlgorithm $enc_algo Content encryption algorithm |
|
| 347 | - * @param Header $header Header |
|
| 348 | - * |
|
| 349 | - * @throws \UnexpectedValueException |
|
| 350 | - * |
|
| 351 | - * @return self |
|
| 352 | - */ |
|
| 353 | - private static function _encryptContent(string $plaintext, string $cek, |
|
| 354 | - string $iv, KeyManagementAlgorithm $key_algo, |
|
| 355 | - ContentEncryptionAlgorithm $enc_algo, Header $header): self |
|
| 356 | - { |
|
| 357 | - // check that content encryption key has correct size |
|
| 358 | - if (strlen($cek) !== $enc_algo->keySize()) { |
|
| 359 | - throw new \UnexpectedValueException('Invalid key size.'); |
|
| 360 | - } |
|
| 361 | - // check that initialization vector has correct size |
|
| 362 | - if (strlen($iv) !== $enc_algo->ivSize()) { |
|
| 363 | - throw new \UnexpectedValueException('Invalid IV size.'); |
|
| 364 | - } |
|
| 365 | - // add key and encryption algorithm parameters to the header |
|
| 366 | - $header = $header->withParameters(...$key_algo->headerParameters()) |
|
| 367 | - ->withParameters(...$enc_algo->headerParameters()); |
|
| 368 | - // encrypt the content encryption key |
|
| 369 | - $encrypted_key = $key_algo->encrypt($cek, $header); |
|
| 370 | - // sanity check that header wasn't unset via reference |
|
| 371 | - if (!$header instanceof Header) { |
|
| 372 | - throw new \RuntimeException('Broken key algorithm.'); |
|
| 373 | - } |
|
| 374 | - // additional authenticated data |
|
| 375 | - $aad = Base64::urlEncode($header->toJSON()); |
|
| 376 | - // encrypt |
|
| 377 | - [$ciphertext, $auth_tag] = $enc_algo->encrypt($plaintext, $cek, $iv, $aad); |
|
| 378 | - // TODO: should aad be passed |
|
| 379 | - return new self($header, $encrypted_key, $iv, $ciphertext, $auth_tag); |
|
| 380 | - } |
|
| 339 | + /** |
|
| 340 | + * Encrypt content with explicit parameters. |
|
| 341 | + * |
|
| 342 | + * @param string $plaintext Plaintext content to encrypt |
|
| 343 | + * @param string $cek Content encryption key |
|
| 344 | + * @param string $iv Initialization vector |
|
| 345 | + * @param KeyManagementAlgorithm $key_algo Key management algorithm |
|
| 346 | + * @param ContentEncryptionAlgorithm $enc_algo Content encryption algorithm |
|
| 347 | + * @param Header $header Header |
|
| 348 | + * |
|
| 349 | + * @throws \UnexpectedValueException |
|
| 350 | + * |
|
| 351 | + * @return self |
|
| 352 | + */ |
|
| 353 | + private static function _encryptContent(string $plaintext, string $cek, |
|
| 354 | + string $iv, KeyManagementAlgorithm $key_algo, |
|
| 355 | + ContentEncryptionAlgorithm $enc_algo, Header $header): self |
|
| 356 | + { |
|
| 357 | + // check that content encryption key has correct size |
|
| 358 | + if (strlen($cek) !== $enc_algo->keySize()) { |
|
| 359 | + throw new \UnexpectedValueException('Invalid key size.'); |
|
| 360 | + } |
|
| 361 | + // check that initialization vector has correct size |
|
| 362 | + if (strlen($iv) !== $enc_algo->ivSize()) { |
|
| 363 | + throw new \UnexpectedValueException('Invalid IV size.'); |
|
| 364 | + } |
|
| 365 | + // add key and encryption algorithm parameters to the header |
|
| 366 | + $header = $header->withParameters(...$key_algo->headerParameters()) |
|
| 367 | + ->withParameters(...$enc_algo->headerParameters()); |
|
| 368 | + // encrypt the content encryption key |
|
| 369 | + $encrypted_key = $key_algo->encrypt($cek, $header); |
|
| 370 | + // sanity check that header wasn't unset via reference |
|
| 371 | + if (!$header instanceof Header) { |
|
| 372 | + throw new \RuntimeException('Broken key algorithm.'); |
|
| 373 | + } |
|
| 374 | + // additional authenticated data |
|
| 375 | + $aad = Base64::urlEncode($header->toJSON()); |
|
| 376 | + // encrypt |
|
| 377 | + [$ciphertext, $auth_tag] = $enc_algo->encrypt($plaintext, $cek, $iv, $aad); |
|
| 378 | + // TODO: should aad be passed |
|
| 379 | + return new self($header, $encrypted_key, $iv, $ciphertext, $auth_tag); |
|
| 380 | + } |
|
| 381 | 381 | } |
@@ -1,6 +1,6 @@ |
||
| 1 | 1 | <?php |
| 2 | 2 | |
| 3 | -declare(strict_types = 1); |
|
| 3 | +declare(strict_types=1); |
|
| 4 | 4 | |
| 5 | 5 | namespace Sop\JWX\JWE; |
| 6 | 6 | |
@@ -1,6 +1,6 @@ |
||
| 1 | 1 | <?php |
| 2 | 2 | |
| 3 | -declare(strict_types = 1); |
|
| 3 | +declare(strict_types=1); |
|
| 4 | 4 | |
| 5 | 5 | namespace Sop\JWX\JWE\EncryptionAlgorithm; |
| 6 | 6 | |
@@ -13,19 +13,19 @@ |
||
| 13 | 13 | */ |
| 14 | 14 | class A128GCMAlgorithm extends AESGCMAlgorithm |
| 15 | 15 | { |
| 16 | - /** |
|
| 17 | - * {@inheritdoc} |
|
| 18 | - */ |
|
| 19 | - public function encryptionAlgorithmParamValue(): string |
|
| 20 | - { |
|
| 21 | - return JWA::ALGO_A128GCM; |
|
| 22 | - } |
|
| 16 | + /** |
|
| 17 | + * {@inheritdoc} |
|
| 18 | + */ |
|
| 19 | + public function encryptionAlgorithmParamValue(): string |
|
| 20 | + { |
|
| 21 | + return JWA::ALGO_A128GCM; |
|
| 22 | + } |
|
| 23 | 23 | |
| 24 | - /** |
|
| 25 | - * {@inheritdoc} |
|
| 26 | - */ |
|
| 27 | - public function keySize(): int |
|
| 28 | - { |
|
| 29 | - return 16; |
|
| 30 | - } |
|
| 24 | + /** |
|
| 25 | + * {@inheritdoc} |
|
| 26 | + */ |
|
| 27 | + public function keySize(): int |
|
| 28 | + { |
|
| 29 | + return 16; |
|
| 30 | + } |
|
| 31 | 31 | } |
@@ -13,59 +13,59 @@ |
||
| 13 | 13 | */ |
| 14 | 14 | class A256CBCHS512Algorithm extends AESCBCAlgorithm |
| 15 | 15 | { |
| 16 | - /** |
|
| 17 | - * {@inheritdoc} |
|
| 18 | - */ |
|
| 19 | - public function keySize(): int |
|
| 20 | - { |
|
| 21 | - return 64; |
|
| 22 | - } |
|
| 16 | + /** |
|
| 17 | + * {@inheritdoc} |
|
| 18 | + */ |
|
| 19 | + public function keySize(): int |
|
| 20 | + { |
|
| 21 | + return 64; |
|
| 22 | + } |
|
| 23 | 23 | |
| 24 | - /** |
|
| 25 | - * {@inheritdoc} |
|
| 26 | - */ |
|
| 27 | - public function encryptionAlgorithmParamValue(): string |
|
| 28 | - { |
|
| 29 | - return JWA::ALGO_A256CBC_HS512; |
|
| 30 | - } |
|
| 24 | + /** |
|
| 25 | + * {@inheritdoc} |
|
| 26 | + */ |
|
| 27 | + public function encryptionAlgorithmParamValue(): string |
|
| 28 | + { |
|
| 29 | + return JWA::ALGO_A256CBC_HS512; |
|
| 30 | + } |
|
| 31 | 31 | |
| 32 | - /** |
|
| 33 | - * {@inheritdoc} |
|
| 34 | - */ |
|
| 35 | - protected function _cipherMethod(): string |
|
| 36 | - { |
|
| 37 | - return 'aes-256-cbc'; |
|
| 38 | - } |
|
| 32 | + /** |
|
| 33 | + * {@inheritdoc} |
|
| 34 | + */ |
|
| 35 | + protected function _cipherMethod(): string |
|
| 36 | + { |
|
| 37 | + return 'aes-256-cbc'; |
|
| 38 | + } |
|
| 39 | 39 | |
| 40 | - /** |
|
| 41 | - * {@inheritdoc} |
|
| 42 | - */ |
|
| 43 | - protected function _hashAlgo(): string |
|
| 44 | - { |
|
| 45 | - return 'sha512'; |
|
| 46 | - } |
|
| 40 | + /** |
|
| 41 | + * {@inheritdoc} |
|
| 42 | + */ |
|
| 43 | + protected function _hashAlgo(): string |
|
| 44 | + { |
|
| 45 | + return 'sha512'; |
|
| 46 | + } |
|
| 47 | 47 | |
| 48 | - /** |
|
| 49 | - * {@inheritdoc} |
|
| 50 | - */ |
|
| 51 | - protected function _encKeyLen(): int |
|
| 52 | - { |
|
| 53 | - return 32; |
|
| 54 | - } |
|
| 48 | + /** |
|
| 49 | + * {@inheritdoc} |
|
| 50 | + */ |
|
| 51 | + protected function _encKeyLen(): int |
|
| 52 | + { |
|
| 53 | + return 32; |
|
| 54 | + } |
|
| 55 | 55 | |
| 56 | - /** |
|
| 57 | - * {@inheritdoc} |
|
| 58 | - */ |
|
| 59 | - protected function _macKeyLen(): int |
|
| 60 | - { |
|
| 61 | - return 32; |
|
| 62 | - } |
|
| 56 | + /** |
|
| 57 | + * {@inheritdoc} |
|
| 58 | + */ |
|
| 59 | + protected function _macKeyLen(): int |
|
| 60 | + { |
|
| 61 | + return 32; |
|
| 62 | + } |
|
| 63 | 63 | |
| 64 | - /** |
|
| 65 | - * {@inheritdoc} |
|
| 66 | - */ |
|
| 67 | - protected function _tagLen(): int |
|
| 68 | - { |
|
| 69 | - return 32; |
|
| 70 | - } |
|
| 64 | + /** |
|
| 65 | + * {@inheritdoc} |
|
| 66 | + */ |
|
| 67 | + protected function _tagLen(): int |
|
| 68 | + { |
|
| 69 | + return 32; |
|
| 70 | + } |
|
| 71 | 71 | } |
@@ -1,6 +1,6 @@ |
||
| 1 | 1 | <?php |
| 2 | 2 | |
| 3 | -declare(strict_types = 1); |
|
| 3 | +declare(strict_types=1); |
|
| 4 | 4 | |
| 5 | 5 | namespace Sop\JWX\JWE\EncryptionAlgorithm; |
| 6 | 6 | |
@@ -13,59 +13,59 @@ |
||
| 13 | 13 | */ |
| 14 | 14 | class A192CBCHS384Algorithm extends AESCBCAlgorithm |
| 15 | 15 | { |
| 16 | - /** |
|
| 17 | - * {@inheritdoc} |
|
| 18 | - */ |
|
| 19 | - public function keySize(): int |
|
| 20 | - { |
|
| 21 | - return 48; |
|
| 22 | - } |
|
| 16 | + /** |
|
| 17 | + * {@inheritdoc} |
|
| 18 | + */ |
|
| 19 | + public function keySize(): int |
|
| 20 | + { |
|
| 21 | + return 48; |
|
| 22 | + } |
|
| 23 | 23 | |
| 24 | - /** |
|
| 25 | - * {@inheritdoc} |
|
| 26 | - */ |
|
| 27 | - public function encryptionAlgorithmParamValue(): string |
|
| 28 | - { |
|
| 29 | - return JWA::ALGO_A192CBC_HS384; |
|
| 30 | - } |
|
| 24 | + /** |
|
| 25 | + * {@inheritdoc} |
|
| 26 | + */ |
|
| 27 | + public function encryptionAlgorithmParamValue(): string |
|
| 28 | + { |
|
| 29 | + return JWA::ALGO_A192CBC_HS384; |
|
| 30 | + } |
|
| 31 | 31 | |
| 32 | - /** |
|
| 33 | - * {@inheritdoc} |
|
| 34 | - */ |
|
| 35 | - protected function _cipherMethod(): string |
|
| 36 | - { |
|
| 37 | - return 'aes-192-cbc'; |
|
| 38 | - } |
|
| 32 | + /** |
|
| 33 | + * {@inheritdoc} |
|
| 34 | + */ |
|
| 35 | + protected function _cipherMethod(): string |
|
| 36 | + { |
|
| 37 | + return 'aes-192-cbc'; |
|
| 38 | + } |
|
| 39 | 39 | |
| 40 | - /** |
|
| 41 | - * {@inheritdoc} |
|
| 42 | - */ |
|
| 43 | - protected function _hashAlgo(): string |
|
| 44 | - { |
|
| 45 | - return 'sha384'; |
|
| 46 | - } |
|
| 40 | + /** |
|
| 41 | + * {@inheritdoc} |
|
| 42 | + */ |
|
| 43 | + protected function _hashAlgo(): string |
|
| 44 | + { |
|
| 45 | + return 'sha384'; |
|
| 46 | + } |
|
| 47 | 47 | |
| 48 | - /** |
|
| 49 | - * {@inheritdoc} |
|
| 50 | - */ |
|
| 51 | - protected function _encKeyLen(): int |
|
| 52 | - { |
|
| 53 | - return 24; |
|
| 54 | - } |
|
| 48 | + /** |
|
| 49 | + * {@inheritdoc} |
|
| 50 | + */ |
|
| 51 | + protected function _encKeyLen(): int |
|
| 52 | + { |
|
| 53 | + return 24; |
|
| 54 | + } |
|
| 55 | 55 | |
| 56 | - /** |
|
| 57 | - * {@inheritdoc} |
|
| 58 | - */ |
|
| 59 | - protected function _macKeyLen(): int |
|
| 60 | - { |
|
| 61 | - return 24; |
|
| 62 | - } |
|
| 56 | + /** |
|
| 57 | + * {@inheritdoc} |
|
| 58 | + */ |
|
| 59 | + protected function _macKeyLen(): int |
|
| 60 | + { |
|
| 61 | + return 24; |
|
| 62 | + } |
|
| 63 | 63 | |
| 64 | - /** |
|
| 65 | - * {@inheritdoc} |
|
| 66 | - */ |
|
| 67 | - protected function _tagLen(): int |
|
| 68 | - { |
|
| 69 | - return 24; |
|
| 70 | - } |
|
| 64 | + /** |
|
| 65 | + * {@inheritdoc} |
|
| 66 | + */ |
|
| 67 | + protected function _tagLen(): int |
|
| 68 | + { |
|
| 69 | + return 24; |
|
| 70 | + } |
|
| 71 | 71 | } |
@@ -1,6 +1,6 @@ |
||
| 1 | 1 | <?php |
| 2 | 2 | |
| 3 | -declare(strict_types = 1); |
|
| 3 | +declare(strict_types=1); |
|
| 4 | 4 | |
| 5 | 5 | namespace Sop\JWX\JWE\EncryptionAlgorithm; |
| 6 | 6 | |
@@ -13,58 +13,58 @@ |
||
| 13 | 13 | */ |
| 14 | 14 | abstract class EncryptionAlgorithmFactory |
| 15 | 15 | { |
| 16 | - /** |
|
| 17 | - * Mapping from algorithm name to class name. |
|
| 18 | - * |
|
| 19 | - * @internal |
|
| 20 | - * |
|
| 21 | - * @var array |
|
| 22 | - */ |
|
| 23 | - const MAP_ALGO_TO_CLASS = [ |
|
| 24 | - JWA::ALGO_A128CBC_HS256 => A128CBCHS256Algorithm::class, |
|
| 25 | - JWA::ALGO_A192CBC_HS384 => A192CBCHS384Algorithm::class, |
|
| 26 | - JWA::ALGO_A256CBC_HS512 => A256CBCHS512Algorithm::class, |
|
| 27 | - JWA::ALGO_A128GCM => A128GCMAlgorithm::class, |
|
| 28 | - JWA::ALGO_A192GCM => A192GCMAlgorithm::class, |
|
| 29 | - JWA::ALGO_A256GCM => A256GCMAlgorithm::class, |
|
| 30 | - ]; |
|
| 16 | + /** |
|
| 17 | + * Mapping from algorithm name to class name. |
|
| 18 | + * |
|
| 19 | + * @internal |
|
| 20 | + * |
|
| 21 | + * @var array |
|
| 22 | + */ |
|
| 23 | + const MAP_ALGO_TO_CLASS = [ |
|
| 24 | + JWA::ALGO_A128CBC_HS256 => A128CBCHS256Algorithm::class, |
|
| 25 | + JWA::ALGO_A192CBC_HS384 => A192CBCHS384Algorithm::class, |
|
| 26 | + JWA::ALGO_A256CBC_HS512 => A256CBCHS512Algorithm::class, |
|
| 27 | + JWA::ALGO_A128GCM => A128GCMAlgorithm::class, |
|
| 28 | + JWA::ALGO_A192GCM => A192GCMAlgorithm::class, |
|
| 29 | + JWA::ALGO_A256GCM => A256GCMAlgorithm::class, |
|
| 30 | + ]; |
|
| 31 | 31 | |
| 32 | - /** |
|
| 33 | - * Get the content encryption algorithm by algorithm name. |
|
| 34 | - * |
|
| 35 | - * @param string $name Algorithm name |
|
| 36 | - * |
|
| 37 | - * @throws \UnexpectedValueException if algorithm is not supported |
|
| 38 | - * |
|
| 39 | - * @return ContentEncryptionAlgorithm |
|
| 40 | - */ |
|
| 41 | - public static function algoByName(string $name): ContentEncryptionAlgorithm |
|
| 42 | - { |
|
| 43 | - if (!array_key_exists($name, self::MAP_ALGO_TO_CLASS)) { |
|
| 44 | - throw new \UnexpectedValueException( |
|
| 45 | - "No content encryption algorithm '{$name}'."); |
|
| 46 | - } |
|
| 47 | - $cls = self::MAP_ALGO_TO_CLASS[$name]; |
|
| 48 | - return new $cls(); |
|
| 49 | - } |
|
| 32 | + /** |
|
| 33 | + * Get the content encryption algorithm by algorithm name. |
|
| 34 | + * |
|
| 35 | + * @param string $name Algorithm name |
|
| 36 | + * |
|
| 37 | + * @throws \UnexpectedValueException if algorithm is not supported |
|
| 38 | + * |
|
| 39 | + * @return ContentEncryptionAlgorithm |
|
| 40 | + */ |
|
| 41 | + public static function algoByName(string $name): ContentEncryptionAlgorithm |
|
| 42 | + { |
|
| 43 | + if (!array_key_exists($name, self::MAP_ALGO_TO_CLASS)) { |
|
| 44 | + throw new \UnexpectedValueException( |
|
| 45 | + "No content encryption algorithm '{$name}'."); |
|
| 46 | + } |
|
| 47 | + $cls = self::MAP_ALGO_TO_CLASS[$name]; |
|
| 48 | + return new $cls(); |
|
| 49 | + } |
|
| 50 | 50 | |
| 51 | - /** |
|
| 52 | - * Get the content encryption algorithm as specified in the given header. |
|
| 53 | - * |
|
| 54 | - * @param Header $header Header |
|
| 55 | - * |
|
| 56 | - * @throws \UnexpectedValueException If content encryption algorithm |
|
| 57 | - * parameter is not present or algorithm |
|
| 58 | - * is not supported |
|
| 59 | - * |
|
| 60 | - * @return ContentEncryptionAlgorithm |
|
| 61 | - */ |
|
| 62 | - public static function algoByHeader(Header $header): ContentEncryptionAlgorithm |
|
| 63 | - { |
|
| 64 | - if (!$header->hasEncryptionAlgorithm()) { |
|
| 65 | - throw new \UnexpectedValueException( |
|
| 66 | - 'No encryption algorithm parameter.'); |
|
| 67 | - } |
|
| 68 | - return self::algoByName($header->encryptionAlgorithm()->value()); |
|
| 69 | - } |
|
| 51 | + /** |
|
| 52 | + * Get the content encryption algorithm as specified in the given header. |
|
| 53 | + * |
|
| 54 | + * @param Header $header Header |
|
| 55 | + * |
|
| 56 | + * @throws \UnexpectedValueException If content encryption algorithm |
|
| 57 | + * parameter is not present or algorithm |
|
| 58 | + * is not supported |
|
| 59 | + * |
|
| 60 | + * @return ContentEncryptionAlgorithm |
|
| 61 | + */ |
|
| 62 | + public static function algoByHeader(Header $header): ContentEncryptionAlgorithm |
|
| 63 | + { |
|
| 64 | + if (!$header->hasEncryptionAlgorithm()) { |
|
| 65 | + throw new \UnexpectedValueException( |
|
| 66 | + 'No encryption algorithm parameter.'); |
|
| 67 | + } |
|
| 68 | + return self::algoByName($header->encryptionAlgorithm()->value()); |
|
| 69 | + } |
|
| 70 | 70 | } |
@@ -1,6 +1,6 @@ |
||
| 1 | 1 | <?php |
| 2 | 2 | |
| 3 | -declare(strict_types = 1); |
|
| 3 | +declare(strict_types=1); |
|
| 4 | 4 | |
| 5 | 5 | namespace Sop\JWX\JWE\EncryptionAlgorithm; |
| 6 | 6 | |
@@ -15,214 +15,214 @@ |
||
| 15 | 15 | */ |
| 16 | 16 | abstract class AESCBCAlgorithm implements ContentEncryptionAlgorithm |
| 17 | 17 | { |
| 18 | - /** |
|
| 19 | - * {@inheritdoc} |
|
| 20 | - */ |
|
| 21 | - public function encrypt(string $plaintext, string $key, string $iv, |
|
| 22 | - string $aad): array |
|
| 23 | - { |
|
| 24 | - $this->_validateKey($key); |
|
| 25 | - $this->_validateIV($iv); |
|
| 26 | - $ciphertext = openssl_encrypt($plaintext, $this->_getCipherMethod(), |
|
| 27 | - $this->_encKey($key), OPENSSL_RAW_DATA, $iv); |
|
| 28 | - if (false === $ciphertext) { |
|
| 29 | - throw new \RuntimeException( |
|
| 30 | - 'openssl_encrypt() failed: ' . $this->_getLastOpenSSLError()); |
|
| 31 | - } |
|
| 32 | - $auth_data = $aad . $iv . $ciphertext . $this->_aadLen($aad); |
|
| 33 | - $auth_tag = $this->_computeAuthTag($auth_data, $key); |
|
| 34 | - return [$ciphertext, $auth_tag]; |
|
| 35 | - } |
|
| 36 | - |
|
| 37 | - /** |
|
| 38 | - * {@inheritdoc} |
|
| 39 | - */ |
|
| 40 | - public function decrypt(string $ciphertext, string $key, string $iv, |
|
| 41 | - string $aad, string $auth_tag): string |
|
| 42 | - { |
|
| 43 | - $this->_validateKey($key); |
|
| 44 | - $this->_validateIV($iv); |
|
| 45 | - $auth_data = $aad . $iv . $ciphertext . $this->_aadLen($aad); |
|
| 46 | - if ($this->_computeAuthTag($auth_data, $key) !== $auth_tag) { |
|
| 47 | - throw new AuthenticationException('Message authentication failed.'); |
|
| 48 | - } |
|
| 49 | - $plaintext = openssl_decrypt($ciphertext, $this->_getCipherMethod(), |
|
| 50 | - $this->_encKey($key), OPENSSL_RAW_DATA, $iv); |
|
| 51 | - if (false === $plaintext) { |
|
| 52 | - throw new \RuntimeException( |
|
| 53 | - 'openssl_decrypt() failed: ' . $this->_getLastOpenSSLError()); |
|
| 54 | - } |
|
| 55 | - return $plaintext; |
|
| 56 | - } |
|
| 57 | - |
|
| 58 | - /** |
|
| 59 | - * {@inheritdoc} |
|
| 60 | - */ |
|
| 61 | - public function ivSize(): int |
|
| 62 | - { |
|
| 63 | - return 16; |
|
| 64 | - } |
|
| 65 | - |
|
| 66 | - /** |
|
| 67 | - * {@inheritdoc} |
|
| 68 | - */ |
|
| 69 | - public function headerParameters(): array |
|
| 70 | - { |
|
| 71 | - return [EncryptionAlgorithmParameter::fromAlgorithm($this)]; |
|
| 72 | - } |
|
| 73 | - |
|
| 74 | - /** |
|
| 75 | - * Get cipher method name that is recognized by OpenSSL. |
|
| 76 | - * |
|
| 77 | - * @return string |
|
| 78 | - */ |
|
| 79 | - abstract protected function _cipherMethod(): string; |
|
| 80 | - |
|
| 81 | - /** |
|
| 82 | - * Get algorithm name that is recognized by the Hash extension. |
|
| 83 | - * |
|
| 84 | - * @return string |
|
| 85 | - */ |
|
| 86 | - abstract protected function _hashAlgo(): string; |
|
| 87 | - |
|
| 88 | - /** |
|
| 89 | - * Get length of the encryption key. |
|
| 90 | - * |
|
| 91 | - * @return int |
|
| 92 | - */ |
|
| 93 | - abstract protected function _encKeyLen(): int; |
|
| 94 | - |
|
| 95 | - /** |
|
| 96 | - * Get length of the MAC key. |
|
| 97 | - * |
|
| 98 | - * @return int |
|
| 99 | - */ |
|
| 100 | - abstract protected function _macKeyLen(): int; |
|
| 101 | - |
|
| 102 | - /** |
|
| 103 | - * Get length of the authentication tag. |
|
| 104 | - * |
|
| 105 | - * @return int |
|
| 106 | - */ |
|
| 107 | - abstract protected function _tagLen(): int; |
|
| 108 | - |
|
| 109 | - /** |
|
| 110 | - * Get cipher method and verify that it's supported. |
|
| 111 | - * |
|
| 112 | - * @throws \RuntimeException |
|
| 113 | - * |
|
| 114 | - * @return string |
|
| 115 | - */ |
|
| 116 | - final protected function _getCipherMethod(): string |
|
| 117 | - { |
|
| 118 | - static $supported_ciphers; |
|
| 119 | - if (!isset($supported_ciphers)) { |
|
| 120 | - $supported_ciphers = array_flip( |
|
| 121 | - array_map('strtolower', openssl_get_cipher_methods(false))); |
|
| 122 | - } |
|
| 123 | - $method = $this->_cipherMethod(); |
|
| 124 | - if (!isset($supported_ciphers[$method])) { |
|
| 125 | - throw new \RuntimeException( |
|
| 126 | - "Cipher method {$method} is not" . |
|
| 127 | - ' supported by this version of OpenSSL.'); |
|
| 128 | - } |
|
| 129 | - return $method; |
|
| 130 | - } |
|
| 131 | - |
|
| 132 | - /** |
|
| 133 | - * Check that key is valid. |
|
| 134 | - * |
|
| 135 | - * @param string $key |
|
| 136 | - * |
|
| 137 | - * @throws \RuntimeException |
|
| 138 | - */ |
|
| 139 | - final protected function _validateKey(string $key): void |
|
| 140 | - { |
|
| 141 | - if (strlen($key) !== $this->keySize()) { |
|
| 142 | - throw new \RuntimeException('Invalid key size.'); |
|
| 143 | - } |
|
| 144 | - } |
|
| 145 | - |
|
| 146 | - /** |
|
| 147 | - * Check that IV is valid. |
|
| 148 | - * |
|
| 149 | - * @param string $iv |
|
| 150 | - * |
|
| 151 | - * @throws \RuntimeException |
|
| 152 | - */ |
|
| 153 | - final protected function _validateIV(string $iv): void |
|
| 154 | - { |
|
| 155 | - $len = openssl_cipher_iv_length($this->_getCipherMethod()); |
|
| 156 | - if ($len !== strlen($iv)) { |
|
| 157 | - throw new \RuntimeException('Invalid IV length.'); |
|
| 158 | - } |
|
| 159 | - } |
|
| 160 | - |
|
| 161 | - /** |
|
| 162 | - * Get MAC key from CEK. |
|
| 163 | - * |
|
| 164 | - * @param string $key |
|
| 165 | - * |
|
| 166 | - * @return string |
|
| 167 | - */ |
|
| 168 | - final protected function _macKey(string $key): string |
|
| 169 | - { |
|
| 170 | - return substr($key, 0, $this->_macKeyLen()); |
|
| 171 | - } |
|
| 172 | - |
|
| 173 | - /** |
|
| 174 | - * Get encryption key from CEK. |
|
| 175 | - * |
|
| 176 | - * @param string $key |
|
| 177 | - * |
|
| 178 | - * @return string |
|
| 179 | - */ |
|
| 180 | - final protected function _encKey(string $key): string |
|
| 181 | - { |
|
| 182 | - return substr($key, -$this->_encKeyLen()); |
|
| 183 | - } |
|
| 184 | - |
|
| 185 | - /** |
|
| 186 | - * Compute AL value. |
|
| 187 | - * |
|
| 188 | - * @param string $aad |
|
| 189 | - * |
|
| 190 | - * @return string 64 bits |
|
| 191 | - */ |
|
| 192 | - final protected function _aadLen(string $aad): string |
|
| 193 | - { |
|
| 194 | - // truncate on 32 bit hosts |
|
| 195 | - if (PHP_INT_SIZE < 8) { |
|
| 196 | - return "\0\0\0\0" . pack('N', strlen($aad) * 8); |
|
| 197 | - } |
|
| 198 | - return pack('J', strlen($aad) * 8); |
|
| 199 | - } |
|
| 200 | - |
|
| 201 | - /** |
|
| 202 | - * Compute authentication tag. |
|
| 203 | - * |
|
| 204 | - * @param string $data |
|
| 205 | - * @param string $key CEK |
|
| 206 | - * |
|
| 207 | - * @return string |
|
| 208 | - */ |
|
| 209 | - final protected function _computeAuthTag(string $data, string $key): string |
|
| 210 | - { |
|
| 211 | - $tag = hash_hmac($this->_hashAlgo(), $data, $this->_macKey($key), true); |
|
| 212 | - return substr($tag, 0, $this->_tagLen()); |
|
| 213 | - } |
|
| 214 | - |
|
| 215 | - /** |
|
| 216 | - * Get last OpenSSL error message. |
|
| 217 | - * |
|
| 218 | - * @return null|string |
|
| 219 | - */ |
|
| 220 | - protected function _getLastOpenSSLError(): ?string |
|
| 221 | - { |
|
| 222 | - $msg = null; |
|
| 223 | - while (false !== ($err = openssl_error_string())) { |
|
| 224 | - $msg = $err; |
|
| 225 | - } |
|
| 226 | - return $msg; |
|
| 227 | - } |
|
| 18 | + /** |
|
| 19 | + * {@inheritdoc} |
|
| 20 | + */ |
|
| 21 | + public function encrypt(string $plaintext, string $key, string $iv, |
|
| 22 | + string $aad): array |
|
| 23 | + { |
|
| 24 | + $this->_validateKey($key); |
|
| 25 | + $this->_validateIV($iv); |
|
| 26 | + $ciphertext = openssl_encrypt($plaintext, $this->_getCipherMethod(), |
|
| 27 | + $this->_encKey($key), OPENSSL_RAW_DATA, $iv); |
|
| 28 | + if (false === $ciphertext) { |
|
| 29 | + throw new \RuntimeException( |
|
| 30 | + 'openssl_encrypt() failed: ' . $this->_getLastOpenSSLError()); |
|
| 31 | + } |
|
| 32 | + $auth_data = $aad . $iv . $ciphertext . $this->_aadLen($aad); |
|
| 33 | + $auth_tag = $this->_computeAuthTag($auth_data, $key); |
|
| 34 | + return [$ciphertext, $auth_tag]; |
|
| 35 | + } |
|
| 36 | + |
|
| 37 | + /** |
|
| 38 | + * {@inheritdoc} |
|
| 39 | + */ |
|
| 40 | + public function decrypt(string $ciphertext, string $key, string $iv, |
|
| 41 | + string $aad, string $auth_tag): string |
|
| 42 | + { |
|
| 43 | + $this->_validateKey($key); |
|
| 44 | + $this->_validateIV($iv); |
|
| 45 | + $auth_data = $aad . $iv . $ciphertext . $this->_aadLen($aad); |
|
| 46 | + if ($this->_computeAuthTag($auth_data, $key) !== $auth_tag) { |
|
| 47 | + throw new AuthenticationException('Message authentication failed.'); |
|
| 48 | + } |
|
| 49 | + $plaintext = openssl_decrypt($ciphertext, $this->_getCipherMethod(), |
|
| 50 | + $this->_encKey($key), OPENSSL_RAW_DATA, $iv); |
|
| 51 | + if (false === $plaintext) { |
|
| 52 | + throw new \RuntimeException( |
|
| 53 | + 'openssl_decrypt() failed: ' . $this->_getLastOpenSSLError()); |
|
| 54 | + } |
|
| 55 | + return $plaintext; |
|
| 56 | + } |
|
| 57 | + |
|
| 58 | + /** |
|
| 59 | + * {@inheritdoc} |
|
| 60 | + */ |
|
| 61 | + public function ivSize(): int |
|
| 62 | + { |
|
| 63 | + return 16; |
|
| 64 | + } |
|
| 65 | + |
|
| 66 | + /** |
|
| 67 | + * {@inheritdoc} |
|
| 68 | + */ |
|
| 69 | + public function headerParameters(): array |
|
| 70 | + { |
|
| 71 | + return [EncryptionAlgorithmParameter::fromAlgorithm($this)]; |
|
| 72 | + } |
|
| 73 | + |
|
| 74 | + /** |
|
| 75 | + * Get cipher method name that is recognized by OpenSSL. |
|
| 76 | + * |
|
| 77 | + * @return string |
|
| 78 | + */ |
|
| 79 | + abstract protected function _cipherMethod(): string; |
|
| 80 | + |
|
| 81 | + /** |
|
| 82 | + * Get algorithm name that is recognized by the Hash extension. |
|
| 83 | + * |
|
| 84 | + * @return string |
|
| 85 | + */ |
|
| 86 | + abstract protected function _hashAlgo(): string; |
|
| 87 | + |
|
| 88 | + /** |
|
| 89 | + * Get length of the encryption key. |
|
| 90 | + * |
|
| 91 | + * @return int |
|
| 92 | + */ |
|
| 93 | + abstract protected function _encKeyLen(): int; |
|
| 94 | + |
|
| 95 | + /** |
|
| 96 | + * Get length of the MAC key. |
|
| 97 | + * |
|
| 98 | + * @return int |
|
| 99 | + */ |
|
| 100 | + abstract protected function _macKeyLen(): int; |
|
| 101 | + |
|
| 102 | + /** |
|
| 103 | + * Get length of the authentication tag. |
|
| 104 | + * |
|
| 105 | + * @return int |
|
| 106 | + */ |
|
| 107 | + abstract protected function _tagLen(): int; |
|
| 108 | + |
|
| 109 | + /** |
|
| 110 | + * Get cipher method and verify that it's supported. |
|
| 111 | + * |
|
| 112 | + * @throws \RuntimeException |
|
| 113 | + * |
|
| 114 | + * @return string |
|
| 115 | + */ |
|
| 116 | + final protected function _getCipherMethod(): string |
|
| 117 | + { |
|
| 118 | + static $supported_ciphers; |
|
| 119 | + if (!isset($supported_ciphers)) { |
|
| 120 | + $supported_ciphers = array_flip( |
|
| 121 | + array_map('strtolower', openssl_get_cipher_methods(false))); |
|
| 122 | + } |
|
| 123 | + $method = $this->_cipherMethod(); |
|
| 124 | + if (!isset($supported_ciphers[$method])) { |
|
| 125 | + throw new \RuntimeException( |
|
| 126 | + "Cipher method {$method} is not" . |
|
| 127 | + ' supported by this version of OpenSSL.'); |
|
| 128 | + } |
|
| 129 | + return $method; |
|
| 130 | + } |
|
| 131 | + |
|
| 132 | + /** |
|
| 133 | + * Check that key is valid. |
|
| 134 | + * |
|
| 135 | + * @param string $key |
|
| 136 | + * |
|
| 137 | + * @throws \RuntimeException |
|
| 138 | + */ |
|
| 139 | + final protected function _validateKey(string $key): void |
|
| 140 | + { |
|
| 141 | + if (strlen($key) !== $this->keySize()) { |
|
| 142 | + throw new \RuntimeException('Invalid key size.'); |
|
| 143 | + } |
|
| 144 | + } |
|
| 145 | + |
|
| 146 | + /** |
|
| 147 | + * Check that IV is valid. |
|
| 148 | + * |
|
| 149 | + * @param string $iv |
|
| 150 | + * |
|
| 151 | + * @throws \RuntimeException |
|
| 152 | + */ |
|
| 153 | + final protected function _validateIV(string $iv): void |
|
| 154 | + { |
|
| 155 | + $len = openssl_cipher_iv_length($this->_getCipherMethod()); |
|
| 156 | + if ($len !== strlen($iv)) { |
|
| 157 | + throw new \RuntimeException('Invalid IV length.'); |
|
| 158 | + } |
|
| 159 | + } |
|
| 160 | + |
|
| 161 | + /** |
|
| 162 | + * Get MAC key from CEK. |
|
| 163 | + * |
|
| 164 | + * @param string $key |
|
| 165 | + * |
|
| 166 | + * @return string |
|
| 167 | + */ |
|
| 168 | + final protected function _macKey(string $key): string |
|
| 169 | + { |
|
| 170 | + return substr($key, 0, $this->_macKeyLen()); |
|
| 171 | + } |
|
| 172 | + |
|
| 173 | + /** |
|
| 174 | + * Get encryption key from CEK. |
|
| 175 | + * |
|
| 176 | + * @param string $key |
|
| 177 | + * |
|
| 178 | + * @return string |
|
| 179 | + */ |
|
| 180 | + final protected function _encKey(string $key): string |
|
| 181 | + { |
|
| 182 | + return substr($key, -$this->_encKeyLen()); |
|
| 183 | + } |
|
| 184 | + |
|
| 185 | + /** |
|
| 186 | + * Compute AL value. |
|
| 187 | + * |
|
| 188 | + * @param string $aad |
|
| 189 | + * |
|
| 190 | + * @return string 64 bits |
|
| 191 | + */ |
|
| 192 | + final protected function _aadLen(string $aad): string |
|
| 193 | + { |
|
| 194 | + // truncate on 32 bit hosts |
|
| 195 | + if (PHP_INT_SIZE < 8) { |
|
| 196 | + return "\0\0\0\0" . pack('N', strlen($aad) * 8); |
|
| 197 | + } |
|
| 198 | + return pack('J', strlen($aad) * 8); |
|
| 199 | + } |
|
| 200 | + |
|
| 201 | + /** |
|
| 202 | + * Compute authentication tag. |
|
| 203 | + * |
|
| 204 | + * @param string $data |
|
| 205 | + * @param string $key CEK |
|
| 206 | + * |
|
| 207 | + * @return string |
|
| 208 | + */ |
|
| 209 | + final protected function _computeAuthTag(string $data, string $key): string |
|
| 210 | + { |
|
| 211 | + $tag = hash_hmac($this->_hashAlgo(), $data, $this->_macKey($key), true); |
|
| 212 | + return substr($tag, 0, $this->_tagLen()); |
|
| 213 | + } |
|
| 214 | + |
|
| 215 | + /** |
|
| 216 | + * Get last OpenSSL error message. |
|
| 217 | + * |
|
| 218 | + * @return null|string |
|
| 219 | + */ |
|
| 220 | + protected function _getLastOpenSSLError(): ?string |
|
| 221 | + { |
|
| 222 | + $msg = null; |
|
| 223 | + while (false !== ($err = openssl_error_string())) { |
|
| 224 | + $msg = $err; |
|
| 225 | + } |
|
| 226 | + return $msg; |
|
| 227 | + } |
|
| 228 | 228 | } |
@@ -1,6 +1,6 @@ |
||
| 1 | 1 | <?php |
| 2 | 2 | |
| 3 | -declare(strict_types = 1); |
|
| 3 | +declare(strict_types=1); |
|
| 4 | 4 | |
| 5 | 5 | namespace Sop\JWX\JWE\EncryptionAlgorithm; |
| 6 | 6 | |
@@ -13,59 +13,59 @@ |
||
| 13 | 13 | */ |
| 14 | 14 | class A128CBCHS256Algorithm extends AESCBCAlgorithm |
| 15 | 15 | { |
| 16 | - /** |
|
| 17 | - * {@inheritdoc} |
|
| 18 | - */ |
|
| 19 | - public function keySize(): int |
|
| 20 | - { |
|
| 21 | - return 32; |
|
| 22 | - } |
|
| 16 | + /** |
|
| 17 | + * {@inheritdoc} |
|
| 18 | + */ |
|
| 19 | + public function keySize(): int |
|
| 20 | + { |
|
| 21 | + return 32; |
|
| 22 | + } |
|
| 23 | 23 | |
| 24 | - /** |
|
| 25 | - * {@inheritdoc} |
|
| 26 | - */ |
|
| 27 | - public function encryptionAlgorithmParamValue(): string |
|
| 28 | - { |
|
| 29 | - return JWA::ALGO_A128CBC_HS256; |
|
| 30 | - } |
|
| 24 | + /** |
|
| 25 | + * {@inheritdoc} |
|
| 26 | + */ |
|
| 27 | + public function encryptionAlgorithmParamValue(): string |
|
| 28 | + { |
|
| 29 | + return JWA::ALGO_A128CBC_HS256; |
|
| 30 | + } |
|
| 31 | 31 | |
| 32 | - /** |
|
| 33 | - * {@inheritdoc} |
|
| 34 | - */ |
|
| 35 | - protected function _cipherMethod(): string |
|
| 36 | - { |
|
| 37 | - return 'aes-128-cbc'; |
|
| 38 | - } |
|
| 32 | + /** |
|
| 33 | + * {@inheritdoc} |
|
| 34 | + */ |
|
| 35 | + protected function _cipherMethod(): string |
|
| 36 | + { |
|
| 37 | + return 'aes-128-cbc'; |
|
| 38 | + } |
|
| 39 | 39 | |
| 40 | - /** |
|
| 41 | - * {@inheritdoc} |
|
| 42 | - */ |
|
| 43 | - protected function _hashAlgo(): string |
|
| 44 | - { |
|
| 45 | - return 'sha256'; |
|
| 46 | - } |
|
| 40 | + /** |
|
| 41 | + * {@inheritdoc} |
|
| 42 | + */ |
|
| 43 | + protected function _hashAlgo(): string |
|
| 44 | + { |
|
| 45 | + return 'sha256'; |
|
| 46 | + } |
|
| 47 | 47 | |
| 48 | - /** |
|
| 49 | - * {@inheritdoc} |
|
| 50 | - */ |
|
| 51 | - protected function _encKeyLen(): int |
|
| 52 | - { |
|
| 53 | - return 16; |
|
| 54 | - } |
|
| 48 | + /** |
|
| 49 | + * {@inheritdoc} |
|
| 50 | + */ |
|
| 51 | + protected function _encKeyLen(): int |
|
| 52 | + { |
|
| 53 | + return 16; |
|
| 54 | + } |
|
| 55 | 55 | |
| 56 | - /** |
|
| 57 | - * {@inheritdoc} |
|
| 58 | - */ |
|
| 59 | - protected function _macKeyLen(): int |
|
| 60 | - { |
|
| 61 | - return 16; |
|
| 62 | - } |
|
| 56 | + /** |
|
| 57 | + * {@inheritdoc} |
|
| 58 | + */ |
|
| 59 | + protected function _macKeyLen(): int |
|
| 60 | + { |
|
| 61 | + return 16; |
|
| 62 | + } |
|
| 63 | 63 | |
| 64 | - /** |
|
| 65 | - * {@inheritdoc} |
|
| 66 | - */ |
|
| 67 | - protected function _tagLen(): int |
|
| 68 | - { |
|
| 69 | - return 16; |
|
| 70 | - } |
|
| 64 | + /** |
|
| 65 | + * {@inheritdoc} |
|
| 66 | + */ |
|
| 67 | + protected function _tagLen(): int |
|
| 68 | + { |
|
| 69 | + return 16; |
|
| 70 | + } |
|
| 71 | 71 | } |
@@ -1,6 +1,6 @@ |
||
| 1 | 1 | <?php |
| 2 | 2 | |
| 3 | -declare(strict_types = 1); |
|
| 3 | +declare(strict_types=1); |
|
| 4 | 4 | |
| 5 | 5 | namespace Sop\JWX\JWE\EncryptionAlgorithm; |
| 6 | 6 | |
@@ -16,71 +16,71 @@ |
||
| 16 | 16 | */ |
| 17 | 17 | class DeflateAlgorithm implements CompressionAlgorithm |
| 18 | 18 | { |
| 19 | - /** |
|
| 20 | - * Compression level. |
|
| 21 | - * |
|
| 22 | - * @var int |
|
| 23 | - */ |
|
| 24 | - protected $_compressionLevel; |
|
| 19 | + /** |
|
| 20 | + * Compression level. |
|
| 21 | + * |
|
| 22 | + * @var int |
|
| 23 | + */ |
|
| 24 | + protected $_compressionLevel; |
|
| 25 | 25 | |
| 26 | - /** |
|
| 27 | - * Constructor. |
|
| 28 | - * |
|
| 29 | - * @param int $level Compression level 0..9 |
|
| 30 | - */ |
|
| 31 | - public function __construct(int $level = -1) |
|
| 32 | - { |
|
| 33 | - if ($level < -1 || $level > 9) { |
|
| 34 | - throw new \DomainException('Compression level must be -1..9.'); |
|
| 35 | - } |
|
| 36 | - $this->_compressionLevel = $level; |
|
| 37 | - } |
|
| 26 | + /** |
|
| 27 | + * Constructor. |
|
| 28 | + * |
|
| 29 | + * @param int $level Compression level 0..9 |
|
| 30 | + */ |
|
| 31 | + public function __construct(int $level = -1) |
|
| 32 | + { |
|
| 33 | + if ($level < -1 || $level > 9) { |
|
| 34 | + throw new \DomainException('Compression level must be -1..9.'); |
|
| 35 | + } |
|
| 36 | + $this->_compressionLevel = $level; |
|
| 37 | + } |
|
| 38 | 38 | |
| 39 | - /** |
|
| 40 | - * {@inheritdoc} |
|
| 41 | - * |
|
| 42 | - * @throws \RuntimeException |
|
| 43 | - */ |
|
| 44 | - public function compress(string $data): string |
|
| 45 | - { |
|
| 46 | - $ret = @gzdeflate($data, $this->_compressionLevel); |
|
| 47 | - if (false === $ret) { |
|
| 48 | - $err = error_get_last(); |
|
| 49 | - $msg = isset($err) && __FILE__ === $err['file'] ? $err['message'] : null; |
|
| 50 | - throw new \RuntimeException($msg ?? 'gzdeflate() failed.'); |
|
| 51 | - } |
|
| 52 | - return $ret; |
|
| 53 | - } |
|
| 39 | + /** |
|
| 40 | + * {@inheritdoc} |
|
| 41 | + * |
|
| 42 | + * @throws \RuntimeException |
|
| 43 | + */ |
|
| 44 | + public function compress(string $data): string |
|
| 45 | + { |
|
| 46 | + $ret = @gzdeflate($data, $this->_compressionLevel); |
|
| 47 | + if (false === $ret) { |
|
| 48 | + $err = error_get_last(); |
|
| 49 | + $msg = isset($err) && __FILE__ === $err['file'] ? $err['message'] : null; |
|
| 50 | + throw new \RuntimeException($msg ?? 'gzdeflate() failed.'); |
|
| 51 | + } |
|
| 52 | + return $ret; |
|
| 53 | + } |
|
| 54 | 54 | |
| 55 | - /** |
|
| 56 | - * {@inheritdoc} |
|
| 57 | - * |
|
| 58 | - * @throws \RuntimeException |
|
| 59 | - */ |
|
| 60 | - public function decompress(string $data): string |
|
| 61 | - { |
|
| 62 | - $ret = @gzinflate($data); |
|
| 63 | - if (false === $ret) { |
|
| 64 | - $err = error_get_last(); |
|
| 65 | - $msg = isset($err) && __FILE__ === $err['file'] ? $err['message'] : null; |
|
| 66 | - throw new \RuntimeException($msg ?? 'gzinflate() failed.'); |
|
| 67 | - } |
|
| 68 | - return $ret; |
|
| 69 | - } |
|
| 55 | + /** |
|
| 56 | + * {@inheritdoc} |
|
| 57 | + * |
|
| 58 | + * @throws \RuntimeException |
|
| 59 | + */ |
|
| 60 | + public function decompress(string $data): string |
|
| 61 | + { |
|
| 62 | + $ret = @gzinflate($data); |
|
| 63 | + if (false === $ret) { |
|
| 64 | + $err = error_get_last(); |
|
| 65 | + $msg = isset($err) && __FILE__ === $err['file'] ? $err['message'] : null; |
|
| 66 | + throw new \RuntimeException($msg ?? 'gzinflate() failed.'); |
|
| 67 | + } |
|
| 68 | + return $ret; |
|
| 69 | + } |
|
| 70 | 70 | |
| 71 | - /** |
|
| 72 | - * {@inheritdoc} |
|
| 73 | - */ |
|
| 74 | - public function compressionParamValue(): string |
|
| 75 | - { |
|
| 76 | - return JWA::ALGO_DEFLATE; |
|
| 77 | - } |
|
| 71 | + /** |
|
| 72 | + * {@inheritdoc} |
|
| 73 | + */ |
|
| 74 | + public function compressionParamValue(): string |
|
| 75 | + { |
|
| 76 | + return JWA::ALGO_DEFLATE; |
|
| 77 | + } |
|
| 78 | 78 | |
| 79 | - /** |
|
| 80 | - * {@inheritdoc} |
|
| 81 | - */ |
|
| 82 | - public function headerParameters(): array |
|
| 83 | - { |
|
| 84 | - return [CompressionAlgorithmParameter::fromAlgorithm($this)]; |
|
| 85 | - } |
|
| 79 | + /** |
|
| 80 | + * {@inheritdoc} |
|
| 81 | + */ |
|
| 82 | + public function headerParameters(): array |
|
| 83 | + { |
|
| 84 | + return [CompressionAlgorithmParameter::fromAlgorithm($this)]; |
|
| 85 | + } |
|
| 86 | 86 | } |
@@ -1,6 +1,6 @@ |
||
| 1 | 1 | <?php |
| 2 | 2 | |
| 3 | -declare(strict_types = 1); |
|
| 3 | +declare(strict_types=1); |
|
| 4 | 4 | |
| 5 | 5 | namespace Sop\JWX\JWE\CompressionAlgorithm; |
| 6 | 6 | |
@@ -13,52 +13,52 @@ |
||
| 13 | 13 | */ |
| 14 | 14 | abstract class CompressionFactory |
| 15 | 15 | { |
| 16 | - /** |
|
| 17 | - * Mapping from algorithm name to class name. |
|
| 18 | - * |
|
| 19 | - * @internal |
|
| 20 | - * |
|
| 21 | - * @var array |
|
| 22 | - */ |
|
| 23 | - const MAP_ALGO_TO_CLASS = [ |
|
| 24 | - JWA::ALGO_DEFLATE => DeflateAlgorithm::class, |
|
| 25 | - ]; |
|
| 16 | + /** |
|
| 17 | + * Mapping from algorithm name to class name. |
|
| 18 | + * |
|
| 19 | + * @internal |
|
| 20 | + * |
|
| 21 | + * @var array |
|
| 22 | + */ |
|
| 23 | + const MAP_ALGO_TO_CLASS = [ |
|
| 24 | + JWA::ALGO_DEFLATE => DeflateAlgorithm::class, |
|
| 25 | + ]; |
|
| 26 | 26 | |
| 27 | - /** |
|
| 28 | - * Get the compression algorithm by name. |
|
| 29 | - * |
|
| 30 | - * @param string $name |
|
| 31 | - * |
|
| 32 | - * @throws \UnexpectedValueException If algorithm is not supported |
|
| 33 | - * |
|
| 34 | - * @return CompressionAlgorithm |
|
| 35 | - */ |
|
| 36 | - public static function algoByName(string $name): CompressionAlgorithm |
|
| 37 | - { |
|
| 38 | - if (!array_key_exists($name, self::MAP_ALGO_TO_CLASS)) { |
|
| 39 | - throw new \UnexpectedValueException( |
|
| 40 | - "No compression algorithm '{$name}'."); |
|
| 41 | - } |
|
| 42 | - $cls = self::MAP_ALGO_TO_CLASS[$name]; |
|
| 43 | - return new $cls(); |
|
| 44 | - } |
|
| 27 | + /** |
|
| 28 | + * Get the compression algorithm by name. |
|
| 29 | + * |
|
| 30 | + * @param string $name |
|
| 31 | + * |
|
| 32 | + * @throws \UnexpectedValueException If algorithm is not supported |
|
| 33 | + * |
|
| 34 | + * @return CompressionAlgorithm |
|
| 35 | + */ |
|
| 36 | + public static function algoByName(string $name): CompressionAlgorithm |
|
| 37 | + { |
|
| 38 | + if (!array_key_exists($name, self::MAP_ALGO_TO_CLASS)) { |
|
| 39 | + throw new \UnexpectedValueException( |
|
| 40 | + "No compression algorithm '{$name}'."); |
|
| 41 | + } |
|
| 42 | + $cls = self::MAP_ALGO_TO_CLASS[$name]; |
|
| 43 | + return new $cls(); |
|
| 44 | + } |
|
| 45 | 45 | |
| 46 | - /** |
|
| 47 | - * Get the compression algorithm as specified in the given header. |
|
| 48 | - * |
|
| 49 | - * @param Header $header Header |
|
| 50 | - * |
|
| 51 | - * @throws \UnexpectedValueException If compression algorithm parameter is |
|
| 52 | - * not present or algorithm is not supported |
|
| 53 | - * |
|
| 54 | - * @return CompressionAlgorithm |
|
| 55 | - */ |
|
| 56 | - public static function algoByHeader(Header $header): CompressionAlgorithm |
|
| 57 | - { |
|
| 58 | - if (!$header->hasCompressionAlgorithm()) { |
|
| 59 | - throw new \UnexpectedValueException( |
|
| 60 | - 'No compression algorithm parameter.'); |
|
| 61 | - } |
|
| 62 | - return self::algoByName($header->compressionAlgorithm()->value()); |
|
| 63 | - } |
|
| 46 | + /** |
|
| 47 | + * Get the compression algorithm as specified in the given header. |
|
| 48 | + * |
|
| 49 | + * @param Header $header Header |
|
| 50 | + * |
|
| 51 | + * @throws \UnexpectedValueException If compression algorithm parameter is |
|
| 52 | + * not present or algorithm is not supported |
|
| 53 | + * |
|
| 54 | + * @return CompressionAlgorithm |
|
| 55 | + */ |
|
| 56 | + public static function algoByHeader(Header $header): CompressionAlgorithm |
|
| 57 | + { |
|
| 58 | + if (!$header->hasCompressionAlgorithm()) { |
|
| 59 | + throw new \UnexpectedValueException( |
|
| 60 | + 'No compression algorithm parameter.'); |
|
| 61 | + } |
|
| 62 | + return self::algoByName($header->compressionAlgorithm()->value()); |
|
| 63 | + } |
|
| 64 | 64 | } |
@@ -1,6 +1,6 @@ |
||
| 1 | 1 | <?php |
| 2 | 2 | |
| 3 | -declare(strict_types = 1); |
|
| 3 | +declare(strict_types=1); |
|
| 4 | 4 | |
| 5 | 5 | namespace Sop\JWX\JWE\CompressionAlgorithm; |
| 6 | 6 | |