GitHub Access Token became invalid

It seems like the GitHub access token used for retrieving details about this repository from GitHub became invalid. This might prevent certain types of inspections from being run (in particular, everything related to pull requests).
Please ask an admin of your repository to re-new the access token on this website.
Completed
Push — master ( 59f4b4...e271c1 )
by Joni
03:51
created
lib/JWX/JWE/JWE.php 2 patches
Indentation   +336 added lines, -336 removed lines patch added patch discarded remove patch
@@ -20,362 +20,362 @@
 block discarded – undo
20 20
  */
21 21
 class JWE
22 22
 {
23
-    /**
24
-     * Protected header.
25
-     *
26
-     * @var Header
27
-     */
28
-    protected $_protectedHeader;
23
+	/**
24
+	 * Protected header.
25
+	 *
26
+	 * @var Header
27
+	 */
28
+	protected $_protectedHeader;
29 29
 
30
-    /**
31
-     * Encrypted key.
32
-     *
33
-     * @var string
34
-     */
35
-    protected $_encryptedKey;
30
+	/**
31
+	 * Encrypted key.
32
+	 *
33
+	 * @var string
34
+	 */
35
+	protected $_encryptedKey;
36 36
 
37
-    /**
38
-     * Initialization vector.
39
-     *
40
-     * @var string
41
-     */
42
-    protected $_iv;
37
+	/**
38
+	 * Initialization vector.
39
+	 *
40
+	 * @var string
41
+	 */
42
+	protected $_iv;
43 43
 
44
-    /**
45
-     * Additional authenticated data.
46
-     *
47
-     * @var null|string
48
-     */
49
-    protected $_aad;
44
+	/**
45
+	 * Additional authenticated data.
46
+	 *
47
+	 * @var null|string
48
+	 */
49
+	protected $_aad;
50 50
 
51
-    /**
52
-     * Ciphertext.
53
-     *
54
-     * @var string
55
-     */
56
-    protected $_ciphertext;
51
+	/**
52
+	 * Ciphertext.
53
+	 *
54
+	 * @var string
55
+	 */
56
+	protected $_ciphertext;
57 57
 
58
-    /**
59
-     * Authentication tag.
60
-     *
61
-     * @var string
62
-     */
63
-    protected $_authenticationTag;
58
+	/**
59
+	 * Authentication tag.
60
+	 *
61
+	 * @var string
62
+	 */
63
+	protected $_authenticationTag;
64 64
 
65
-    /**
66
-     * Constructor.
67
-     *
68
-     * @param Header      $protected_header JWE Protected Header
69
-     * @param string      $encrypted_key    Encrypted key
70
-     * @param string      $iv               Initialization vector
71
-     * @param string      $ciphertext       Ciphertext
72
-     * @param string      $auth_tag         Authentication tag
73
-     * @param null|string $aad              Additional authenticated data
74
-     */
75
-    public function __construct(Header $protected_header, string $encrypted_key,
76
-        string $iv, string $ciphertext, string $auth_tag, ?string $aad = null)
77
-    {
78
-        $this->_protectedHeader = $protected_header;
79
-        $this->_encryptedKey = $encrypted_key;
80
-        $this->_iv = $iv;
81
-        $this->_aad = $aad;
82
-        $this->_ciphertext = $ciphertext;
83
-        $this->_authenticationTag = $auth_tag;
84
-    }
65
+	/**
66
+	 * Constructor.
67
+	 *
68
+	 * @param Header      $protected_header JWE Protected Header
69
+	 * @param string      $encrypted_key    Encrypted key
70
+	 * @param string      $iv               Initialization vector
71
+	 * @param string      $ciphertext       Ciphertext
72
+	 * @param string      $auth_tag         Authentication tag
73
+	 * @param null|string $aad              Additional authenticated data
74
+	 */
75
+	public function __construct(Header $protected_header, string $encrypted_key,
76
+		string $iv, string $ciphertext, string $auth_tag, ?string $aad = null)
77
+	{
78
+		$this->_protectedHeader = $protected_header;
79
+		$this->_encryptedKey = $encrypted_key;
80
+		$this->_iv = $iv;
81
+		$this->_aad = $aad;
82
+		$this->_ciphertext = $ciphertext;
83
+		$this->_authenticationTag = $auth_tag;
84
+	}
85 85
 
86
-    /**
87
-     * Convert JWE to string.
88
-     *
89
-     * @return string
90
-     */
91
-    public function __toString(): string
92
-    {
93
-        return $this->toCompact();
94
-    }
86
+	/**
87
+	 * Convert JWE to string.
88
+	 *
89
+	 * @return string
90
+	 */
91
+	public function __toString(): string
92
+	{
93
+		return $this->toCompact();
94
+	}
95 95
 
96
-    /**
97
-     * Initialize from compact serialization.
98
-     *
99
-     * @param string $data
100
-     *
101
-     * @return self
102
-     */
103
-    public static function fromCompact(string $data): self
104
-    {
105
-        return self::fromParts(explode('.', $data));
106
-    }
96
+	/**
97
+	 * Initialize from compact serialization.
98
+	 *
99
+	 * @param string $data
100
+	 *
101
+	 * @return self
102
+	 */
103
+	public static function fromCompact(string $data): self
104
+	{
105
+		return self::fromParts(explode('.', $data));
106
+	}
107 107
 
108
-    /**
109
-     * Initialize from parts of compact serialization.
110
-     *
111
-     * @param array $parts
112
-     *
113
-     * @throws \UnexpectedValueException
114
-     *
115
-     * @return self
116
-     */
117
-    public static function fromParts(array $parts): self
118
-    {
119
-        if (5 !== count($parts)) {
120
-            throw new \UnexpectedValueException(
121
-                'Invalid JWE compact serialization.');
122
-        }
123
-        $header = Header::fromJSON(Base64::urlDecode($parts[0]));
124
-        $encrypted_key = Base64::urlDecode($parts[1]);
125
-        $iv = Base64::urlDecode($parts[2]);
126
-        $ciphertext = Base64::urlDecode($parts[3]);
127
-        $auth_tag = Base64::urlDecode($parts[4]);
128
-        return new self($header, $encrypted_key, $iv, $ciphertext, $auth_tag);
129
-    }
108
+	/**
109
+	 * Initialize from parts of compact serialization.
110
+	 *
111
+	 * @param array $parts
112
+	 *
113
+	 * @throws \UnexpectedValueException
114
+	 *
115
+	 * @return self
116
+	 */
117
+	public static function fromParts(array $parts): self
118
+	{
119
+		if (5 !== count($parts)) {
120
+			throw new \UnexpectedValueException(
121
+				'Invalid JWE compact serialization.');
122
+		}
123
+		$header = Header::fromJSON(Base64::urlDecode($parts[0]));
124
+		$encrypted_key = Base64::urlDecode($parts[1]);
125
+		$iv = Base64::urlDecode($parts[2]);
126
+		$ciphertext = Base64::urlDecode($parts[3]);
127
+		$auth_tag = Base64::urlDecode($parts[4]);
128
+		return new self($header, $encrypted_key, $iv, $ciphertext, $auth_tag);
129
+	}
130 130
 
131
-    /**
132
-     * Initialize by encrypting the given payload.
133
-     *
134
-     * @param string                     $payload  Payload
135
-     * @param KeyManagementAlgorithm     $key_algo Key management algorithm
136
-     * @param ContentEncryptionAlgorithm $enc_algo Content encryption algorithm
137
-     * @param null|CompressionAlgorithm  $zip_algo Optional compression algorithm
138
-     * @param null|Header                $header   Optional desired header.
139
-     *                                             Algorithm specific parameters are
140
-     *                                             automatically added.
141
-     * @param null|string                $cek      Optional content encryption key.
142
-     *                                             Randomly enerated if not set.
143
-     * @param null|string                $iv       Optional initialization vector.
144
-     *                                             Randomly generated if not set.
145
-     *
146
-     * @throws \RuntimeException If encrypt fails
147
-     *
148
-     * @return self
149
-     */
150
-    public static function encrypt(string $payload,
151
-        KeyManagementAlgorithm $key_algo, ContentEncryptionAlgorithm $enc_algo,
152
-        ?CompressionAlgorithm $zip_algo = null, ?Header $header = null,
153
-        ?string $cek = null, ?string $iv = null): self
154
-    {
155
-        // if header was not given, initialize empty
156
-        if (!isset($header)) {
157
-            $header = new Header();
158
-        }
159
-        // generate random CEK
160
-        if (!isset($cek)) {
161
-            $cek = $key_algo->cekForEncryption($enc_algo->keySize());
162
-        }
163
-        // generate random IV
164
-        if (!isset($iv)) {
165
-            $iv = openssl_random_pseudo_bytes($enc_algo->ivSize());
166
-        }
167
-        // compress
168
-        if (isset($zip_algo)) {
169
-            $payload = $zip_algo->compress($payload);
170
-            $header = $header->withParameters(...$zip_algo->headerParameters());
171
-        }
172
-        return self::_encryptContent($payload, $cek, $iv,
173
-            $key_algo, $enc_algo, $header);
174
-    }
131
+	/**
132
+	 * Initialize by encrypting the given payload.
133
+	 *
134
+	 * @param string                     $payload  Payload
135
+	 * @param KeyManagementAlgorithm     $key_algo Key management algorithm
136
+	 * @param ContentEncryptionAlgorithm $enc_algo Content encryption algorithm
137
+	 * @param null|CompressionAlgorithm  $zip_algo Optional compression algorithm
138
+	 * @param null|Header                $header   Optional desired header.
139
+	 *                                             Algorithm specific parameters are
140
+	 *                                             automatically added.
141
+	 * @param null|string                $cek      Optional content encryption key.
142
+	 *                                             Randomly enerated if not set.
143
+	 * @param null|string                $iv       Optional initialization vector.
144
+	 *                                             Randomly generated if not set.
145
+	 *
146
+	 * @throws \RuntimeException If encrypt fails
147
+	 *
148
+	 * @return self
149
+	 */
150
+	public static function encrypt(string $payload,
151
+		KeyManagementAlgorithm $key_algo, ContentEncryptionAlgorithm $enc_algo,
152
+		?CompressionAlgorithm $zip_algo = null, ?Header $header = null,
153
+		?string $cek = null, ?string $iv = null): self
154
+	{
155
+		// if header was not given, initialize empty
156
+		if (!isset($header)) {
157
+			$header = new Header();
158
+		}
159
+		// generate random CEK
160
+		if (!isset($cek)) {
161
+			$cek = $key_algo->cekForEncryption($enc_algo->keySize());
162
+		}
163
+		// generate random IV
164
+		if (!isset($iv)) {
165
+			$iv = openssl_random_pseudo_bytes($enc_algo->ivSize());
166
+		}
167
+		// compress
168
+		if (isset($zip_algo)) {
169
+			$payload = $zip_algo->compress($payload);
170
+			$header = $header->withParameters(...$zip_algo->headerParameters());
171
+		}
172
+		return self::_encryptContent($payload, $cek, $iv,
173
+			$key_algo, $enc_algo, $header);
174
+	}
175 175
 
176
-    /**
177
-     * Decrypt the content using explicit algorithms.
178
-     *
179
-     * @param KeyManagementAlgorithm     $key_algo Key management algorithm
180
-     * @param ContentEncryptionAlgorithm $enc_algo Content encryption algorithm
181
-     *
182
-     * @throws \RuntimeException If decrypt fails
183
-     *
184
-     * @return string Plaintext payload
185
-     */
186
-    public function decrypt(KeyManagementAlgorithm $key_algo,
187
-        ContentEncryptionAlgorithm $enc_algo): string
188
-    {
189
-        // check that key management algorithm matches
190
-        if ($key_algo->algorithmParamValue() !== $this->algorithmName()) {
191
-            throw new \UnexpectedValueException(
192
-                'Invalid key management algorithm.');
193
-        }
194
-        // check that encryption algorithm matches
195
-        if ($enc_algo->encryptionAlgorithmParamValue() !== $this->encryptionAlgorithmName()) {
196
-            throw new \UnexpectedValueException('Invalid encryption algorithm.');
197
-        }
198
-        $header = $this->header();
199
-        // decrypt content encryption key
200
-        $cek = $key_algo->decrypt($this->_encryptedKey, $header);
201
-        // decrypt payload
202
-        $aad = Base64::urlEncode($this->_protectedHeader->toJSON());
203
-        $payload = $enc_algo->decrypt($this->_ciphertext, $cek,
204
-            $this->_iv, $aad, $this->_authenticationTag);
205
-        // decompress
206
-        if ($header->hasCompressionAlgorithm()) {
207
-            $payload = CompressionFactory::algoByHeader($header)->decompress($payload);
208
-        }
209
-        return $payload;
210
-    }
176
+	/**
177
+	 * Decrypt the content using explicit algorithms.
178
+	 *
179
+	 * @param KeyManagementAlgorithm     $key_algo Key management algorithm
180
+	 * @param ContentEncryptionAlgorithm $enc_algo Content encryption algorithm
181
+	 *
182
+	 * @throws \RuntimeException If decrypt fails
183
+	 *
184
+	 * @return string Plaintext payload
185
+	 */
186
+	public function decrypt(KeyManagementAlgorithm $key_algo,
187
+		ContentEncryptionAlgorithm $enc_algo): string
188
+	{
189
+		// check that key management algorithm matches
190
+		if ($key_algo->algorithmParamValue() !== $this->algorithmName()) {
191
+			throw new \UnexpectedValueException(
192
+				'Invalid key management algorithm.');
193
+		}
194
+		// check that encryption algorithm matches
195
+		if ($enc_algo->encryptionAlgorithmParamValue() !== $this->encryptionAlgorithmName()) {
196
+			throw new \UnexpectedValueException('Invalid encryption algorithm.');
197
+		}
198
+		$header = $this->header();
199
+		// decrypt content encryption key
200
+		$cek = $key_algo->decrypt($this->_encryptedKey, $header);
201
+		// decrypt payload
202
+		$aad = Base64::urlEncode($this->_protectedHeader->toJSON());
203
+		$payload = $enc_algo->decrypt($this->_ciphertext, $cek,
204
+			$this->_iv, $aad, $this->_authenticationTag);
205
+		// decompress
206
+		if ($header->hasCompressionAlgorithm()) {
207
+			$payload = CompressionFactory::algoByHeader($header)->decompress($payload);
208
+		}
209
+		return $payload;
210
+	}
211 211
 
212
-    /**
213
-     * Decrypt content using given JWK.
214
-     *
215
-     * Key management and content encryption algorithms are determined from the
216
-     * header.
217
-     *
218
-     * @param JWK $jwk JSON Web Key
219
-     *
220
-     * @throws \RuntimeException If algorithm initialization fails
221
-     *
222
-     * @return string Plaintext payload
223
-     */
224
-    public function decryptWithJWK(JWK $jwk): string
225
-    {
226
-        $header = $this->header();
227
-        $key_algo = KeyManagementAlgorithm::fromJWK($jwk, $header);
228
-        $enc_algo = EncryptionAlgorithmFactory::algoByHeader($header);
229
-        return $this->decrypt($key_algo, $enc_algo);
230
-    }
212
+	/**
213
+	 * Decrypt content using given JWK.
214
+	 *
215
+	 * Key management and content encryption algorithms are determined from the
216
+	 * header.
217
+	 *
218
+	 * @param JWK $jwk JSON Web Key
219
+	 *
220
+	 * @throws \RuntimeException If algorithm initialization fails
221
+	 *
222
+	 * @return string Plaintext payload
223
+	 */
224
+	public function decryptWithJWK(JWK $jwk): string
225
+	{
226
+		$header = $this->header();
227
+		$key_algo = KeyManagementAlgorithm::fromJWK($jwk, $header);
228
+		$enc_algo = EncryptionAlgorithmFactory::algoByHeader($header);
229
+		return $this->decrypt($key_algo, $enc_algo);
230
+	}
231 231
 
232
-    /**
233
-     * Decrypt content using a key from the given JWK set.
234
-     *
235
-     * Correct key shall be sought by the key ID indicated by the header.
236
-     *
237
-     * @param JWKSet $set Set of JSON Web Keys
238
-     *
239
-     * @throws \RuntimeException If algorithm initialization fails
240
-     *
241
-     * @return string Plaintext payload
242
-     */
243
-    public function decryptWithJWKSet(JWKSet $set): string
244
-    {
245
-        if (!count($set)) {
246
-            throw new \RuntimeException('No keys.');
247
-        }
248
-        $header = $this->header();
249
-        $factory = new KeyAlgorithmFactory($header);
250
-        $key_algo = $factory->algoByKeys($set);
251
-        $enc_algo = EncryptionAlgorithmFactory::algoByHeader($header);
252
-        return $this->decrypt($key_algo, $enc_algo);
253
-    }
232
+	/**
233
+	 * Decrypt content using a key from the given JWK set.
234
+	 *
235
+	 * Correct key shall be sought by the key ID indicated by the header.
236
+	 *
237
+	 * @param JWKSet $set Set of JSON Web Keys
238
+	 *
239
+	 * @throws \RuntimeException If algorithm initialization fails
240
+	 *
241
+	 * @return string Plaintext payload
242
+	 */
243
+	public function decryptWithJWKSet(JWKSet $set): string
244
+	{
245
+		if (!count($set)) {
246
+			throw new \RuntimeException('No keys.');
247
+		}
248
+		$header = $this->header();
249
+		$factory = new KeyAlgorithmFactory($header);
250
+		$key_algo = $factory->algoByKeys($set);
251
+		$enc_algo = EncryptionAlgorithmFactory::algoByHeader($header);
252
+		return $this->decrypt($key_algo, $enc_algo);
253
+	}
254 254
 
255
-    /**
256
-     * Get JOSE header.
257
-     *
258
-     * @return JOSE
259
-     */
260
-    public function header(): JOSE
261
-    {
262
-        return new JOSE($this->_protectedHeader);
263
-    }
255
+	/**
256
+	 * Get JOSE header.
257
+	 *
258
+	 * @return JOSE
259
+	 */
260
+	public function header(): JOSE
261
+	{
262
+		return new JOSE($this->_protectedHeader);
263
+	}
264 264
 
265
-    /**
266
-     * Get the name of the key management algorithm.
267
-     *
268
-     * @return string
269
-     */
270
-    public function algorithmName(): string
271
-    {
272
-        return $this->header()->algorithm()->value();
273
-    }
265
+	/**
266
+	 * Get the name of the key management algorithm.
267
+	 *
268
+	 * @return string
269
+	 */
270
+	public function algorithmName(): string
271
+	{
272
+		return $this->header()->algorithm()->value();
273
+	}
274 274
 
275
-    /**
276
-     * Get the name of the encryption algorithm.
277
-     *
278
-     * @return string
279
-     */
280
-    public function encryptionAlgorithmName(): string
281
-    {
282
-        return $this->header()->encryptionAlgorithm()->value();
283
-    }
275
+	/**
276
+	 * Get the name of the encryption algorithm.
277
+	 *
278
+	 * @return string
279
+	 */
280
+	public function encryptionAlgorithmName(): string
281
+	{
282
+		return $this->header()->encryptionAlgorithm()->value();
283
+	}
284 284
 
285
-    /**
286
-     * Get encrypted CEK.
287
-     *
288
-     * @return string
289
-     */
290
-    public function encryptedKey(): string
291
-    {
292
-        return $this->_encryptedKey;
293
-    }
285
+	/**
286
+	 * Get encrypted CEK.
287
+	 *
288
+	 * @return string
289
+	 */
290
+	public function encryptedKey(): string
291
+	{
292
+		return $this->_encryptedKey;
293
+	}
294 294
 
295
-    /**
296
-     * Get initialization vector.
297
-     *
298
-     * @return string
299
-     */
300
-    public function initializationVector(): string
301
-    {
302
-        return $this->_iv;
303
-    }
295
+	/**
296
+	 * Get initialization vector.
297
+	 *
298
+	 * @return string
299
+	 */
300
+	public function initializationVector(): string
301
+	{
302
+		return $this->_iv;
303
+	}
304 304
 
305
-    /**
306
-     * Get ciphertext.
307
-     *
308
-     * @return string
309
-     */
310
-    public function ciphertext(): string
311
-    {
312
-        return $this->_ciphertext;
313
-    }
305
+	/**
306
+	 * Get ciphertext.
307
+	 *
308
+	 * @return string
309
+	 */
310
+	public function ciphertext(): string
311
+	{
312
+		return $this->_ciphertext;
313
+	}
314 314
 
315
-    /**
316
-     * Get authentication tag.
317
-     *
318
-     * @return string
319
-     */
320
-    public function authenticationTag(): string
321
-    {
322
-        return $this->_authenticationTag;
323
-    }
315
+	/**
316
+	 * Get authentication tag.
317
+	 *
318
+	 * @return string
319
+	 */
320
+	public function authenticationTag(): string
321
+	{
322
+		return $this->_authenticationTag;
323
+	}
324 324
 
325
-    /**
326
-     * Convert to compact serialization.
327
-     *
328
-     * @return string
329
-     */
330
-    public function toCompact(): string
331
-    {
332
-        return Base64::urlEncode($this->_protectedHeader->toJSON()) . '.' .
333
-             Base64::urlEncode($this->_encryptedKey) . '.' .
334
-             Base64::urlEncode($this->_iv) . '.' .
335
-             Base64::urlEncode($this->_ciphertext) . '.' .
336
-             Base64::urlEncode($this->_authenticationTag);
337
-    }
325
+	/**
326
+	 * Convert to compact serialization.
327
+	 *
328
+	 * @return string
329
+	 */
330
+	public function toCompact(): string
331
+	{
332
+		return Base64::urlEncode($this->_protectedHeader->toJSON()) . '.' .
333
+			 Base64::urlEncode($this->_encryptedKey) . '.' .
334
+			 Base64::urlEncode($this->_iv) . '.' .
335
+			 Base64::urlEncode($this->_ciphertext) . '.' .
336
+			 Base64::urlEncode($this->_authenticationTag);
337
+	}
338 338
 
339
-    /**
340
-     * Encrypt content with explicit parameters.
341
-     *
342
-     * @param string                     $plaintext Plaintext content to encrypt
343
-     * @param string                     $cek       Content encryption key
344
-     * @param string                     $iv        Initialization vector
345
-     * @param KeyManagementAlgorithm     $key_algo  Key management algorithm
346
-     * @param ContentEncryptionAlgorithm $enc_algo  Content encryption algorithm
347
-     * @param Header                     $header    Header
348
-     *
349
-     * @throws \UnexpectedValueException
350
-     *
351
-     * @return self
352
-     */
353
-    private static function _encryptContent(string $plaintext, string $cek,
354
-        string $iv, KeyManagementAlgorithm $key_algo,
355
-        ContentEncryptionAlgorithm $enc_algo, Header $header): self
356
-    {
357
-        // check that content encryption key has correct size
358
-        if (strlen($cek) !== $enc_algo->keySize()) {
359
-            throw new \UnexpectedValueException('Invalid key size.');
360
-        }
361
-        // check that initialization vector has correct size
362
-        if (strlen($iv) !== $enc_algo->ivSize()) {
363
-            throw new \UnexpectedValueException('Invalid IV size.');
364
-        }
365
-        // add key and encryption algorithm parameters to the header
366
-        $header = $header->withParameters(...$key_algo->headerParameters())
367
-            ->withParameters(...$enc_algo->headerParameters());
368
-        // encrypt the content encryption key
369
-        $encrypted_key = $key_algo->encrypt($cek, $header);
370
-        // sanity check that header wasn't unset via reference
371
-        if (!$header instanceof Header) {
372
-            throw new \RuntimeException('Broken key algorithm.');
373
-        }
374
-        // additional authenticated data
375
-        $aad = Base64::urlEncode($header->toJSON());
376
-        // encrypt
377
-        [$ciphertext, $auth_tag] = $enc_algo->encrypt($plaintext, $cek, $iv, $aad);
378
-        // TODO: should aad be passed
379
-        return new self($header, $encrypted_key, $iv, $ciphertext, $auth_tag);
380
-    }
339
+	/**
340
+	 * Encrypt content with explicit parameters.
341
+	 *
342
+	 * @param string                     $plaintext Plaintext content to encrypt
343
+	 * @param string                     $cek       Content encryption key
344
+	 * @param string                     $iv        Initialization vector
345
+	 * @param KeyManagementAlgorithm     $key_algo  Key management algorithm
346
+	 * @param ContentEncryptionAlgorithm $enc_algo  Content encryption algorithm
347
+	 * @param Header                     $header    Header
348
+	 *
349
+	 * @throws \UnexpectedValueException
350
+	 *
351
+	 * @return self
352
+	 */
353
+	private static function _encryptContent(string $plaintext, string $cek,
354
+		string $iv, KeyManagementAlgorithm $key_algo,
355
+		ContentEncryptionAlgorithm $enc_algo, Header $header): self
356
+	{
357
+		// check that content encryption key has correct size
358
+		if (strlen($cek) !== $enc_algo->keySize()) {
359
+			throw new \UnexpectedValueException('Invalid key size.');
360
+		}
361
+		// check that initialization vector has correct size
362
+		if (strlen($iv) !== $enc_algo->ivSize()) {
363
+			throw new \UnexpectedValueException('Invalid IV size.');
364
+		}
365
+		// add key and encryption algorithm parameters to the header
366
+		$header = $header->withParameters(...$key_algo->headerParameters())
367
+			->withParameters(...$enc_algo->headerParameters());
368
+		// encrypt the content encryption key
369
+		$encrypted_key = $key_algo->encrypt($cek, $header);
370
+		// sanity check that header wasn't unset via reference
371
+		if (!$header instanceof Header) {
372
+			throw new \RuntimeException('Broken key algorithm.');
373
+		}
374
+		// additional authenticated data
375
+		$aad = Base64::urlEncode($header->toJSON());
376
+		// encrypt
377
+		[$ciphertext, $auth_tag] = $enc_algo->encrypt($plaintext, $cek, $iv, $aad);
378
+		// TODO: should aad be passed
379
+		return new self($header, $encrypted_key, $iv, $ciphertext, $auth_tag);
380
+	}
381 381
 }
Please login to merge, or discard this patch.
Spacing   +1 added lines, -1 removed lines patch added patch discarded remove patch
@@ -1,6 +1,6 @@
 block discarded – undo
1 1
 <?php
2 2
 
3
-declare(strict_types = 1);
3
+declare(strict_types=1);
4 4
 
5 5
 namespace Sop\JWX\JWE;
6 6
 
Please login to merge, or discard this patch.
lib/JWX/JWE/EncryptionAlgorithm/A128GCMAlgorithm.php 2 patches
Spacing   +1 added lines, -1 removed lines patch added patch discarded remove patch
@@ -1,6 +1,6 @@
 block discarded – undo
1 1
 <?php
2 2
 
3
-declare(strict_types = 1);
3
+declare(strict_types=1);
4 4
 
5 5
 namespace Sop\JWX\JWE\EncryptionAlgorithm;
6 6
 
Please login to merge, or discard this patch.
Indentation   +14 added lines, -14 removed lines patch added patch discarded remove patch
@@ -13,19 +13,19 @@
 block discarded – undo
13 13
  */
14 14
 class A128GCMAlgorithm extends AESGCMAlgorithm
15 15
 {
16
-    /**
17
-     * {@inheritdoc}
18
-     */
19
-    public function encryptionAlgorithmParamValue(): string
20
-    {
21
-        return JWA::ALGO_A128GCM;
22
-    }
16
+	/**
17
+	 * {@inheritdoc}
18
+	 */
19
+	public function encryptionAlgorithmParamValue(): string
20
+	{
21
+		return JWA::ALGO_A128GCM;
22
+	}
23 23
 
24
-    /**
25
-     * {@inheritdoc}
26
-     */
27
-    public function keySize(): int
28
-    {
29
-        return 16;
30
-    }
24
+	/**
25
+	 * {@inheritdoc}
26
+	 */
27
+	public function keySize(): int
28
+	{
29
+		return 16;
30
+	}
31 31
 }
Please login to merge, or discard this patch.
lib/JWX/JWE/EncryptionAlgorithm/A256CBCHS512Algorithm.php 2 patches
Indentation   +49 added lines, -49 removed lines patch added patch discarded remove patch
@@ -13,59 +13,59 @@
 block discarded – undo
13 13
  */
14 14
 class A256CBCHS512Algorithm extends AESCBCAlgorithm
15 15
 {
16
-    /**
17
-     * {@inheritdoc}
18
-     */
19
-    public function keySize(): int
20
-    {
21
-        return 64;
22
-    }
16
+	/**
17
+	 * {@inheritdoc}
18
+	 */
19
+	public function keySize(): int
20
+	{
21
+		return 64;
22
+	}
23 23
 
24
-    /**
25
-     * {@inheritdoc}
26
-     */
27
-    public function encryptionAlgorithmParamValue(): string
28
-    {
29
-        return JWA::ALGO_A256CBC_HS512;
30
-    }
24
+	/**
25
+	 * {@inheritdoc}
26
+	 */
27
+	public function encryptionAlgorithmParamValue(): string
28
+	{
29
+		return JWA::ALGO_A256CBC_HS512;
30
+	}
31 31
 
32
-    /**
33
-     * {@inheritdoc}
34
-     */
35
-    protected function _cipherMethod(): string
36
-    {
37
-        return 'aes-256-cbc';
38
-    }
32
+	/**
33
+	 * {@inheritdoc}
34
+	 */
35
+	protected function _cipherMethod(): string
36
+	{
37
+		return 'aes-256-cbc';
38
+	}
39 39
 
40
-    /**
41
-     * {@inheritdoc}
42
-     */
43
-    protected function _hashAlgo(): string
44
-    {
45
-        return 'sha512';
46
-    }
40
+	/**
41
+	 * {@inheritdoc}
42
+	 */
43
+	protected function _hashAlgo(): string
44
+	{
45
+		return 'sha512';
46
+	}
47 47
 
48
-    /**
49
-     * {@inheritdoc}
50
-     */
51
-    protected function _encKeyLen(): int
52
-    {
53
-        return 32;
54
-    }
48
+	/**
49
+	 * {@inheritdoc}
50
+	 */
51
+	protected function _encKeyLen(): int
52
+	{
53
+		return 32;
54
+	}
55 55
 
56
-    /**
57
-     * {@inheritdoc}
58
-     */
59
-    protected function _macKeyLen(): int
60
-    {
61
-        return 32;
62
-    }
56
+	/**
57
+	 * {@inheritdoc}
58
+	 */
59
+	protected function _macKeyLen(): int
60
+	{
61
+		return 32;
62
+	}
63 63
 
64
-    /**
65
-     * {@inheritdoc}
66
-     */
67
-    protected function _tagLen(): int
68
-    {
69
-        return 32;
70
-    }
64
+	/**
65
+	 * {@inheritdoc}
66
+	 */
67
+	protected function _tagLen(): int
68
+	{
69
+		return 32;
70
+	}
71 71
 }
Please login to merge, or discard this patch.
Spacing   +1 added lines, -1 removed lines patch added patch discarded remove patch
@@ -1,6 +1,6 @@
 block discarded – undo
1 1
 <?php
2 2
 
3
-declare(strict_types = 1);
3
+declare(strict_types=1);
4 4
 
5 5
 namespace Sop\JWX\JWE\EncryptionAlgorithm;
6 6
 
Please login to merge, or discard this patch.
lib/JWX/JWE/EncryptionAlgorithm/A192CBCHS384Algorithm.php 2 patches
Indentation   +49 added lines, -49 removed lines patch added patch discarded remove patch
@@ -13,59 +13,59 @@
 block discarded – undo
13 13
  */
14 14
 class A192CBCHS384Algorithm extends AESCBCAlgorithm
15 15
 {
16
-    /**
17
-     * {@inheritdoc}
18
-     */
19
-    public function keySize(): int
20
-    {
21
-        return 48;
22
-    }
16
+	/**
17
+	 * {@inheritdoc}
18
+	 */
19
+	public function keySize(): int
20
+	{
21
+		return 48;
22
+	}
23 23
 
24
-    /**
25
-     * {@inheritdoc}
26
-     */
27
-    public function encryptionAlgorithmParamValue(): string
28
-    {
29
-        return JWA::ALGO_A192CBC_HS384;
30
-    }
24
+	/**
25
+	 * {@inheritdoc}
26
+	 */
27
+	public function encryptionAlgorithmParamValue(): string
28
+	{
29
+		return JWA::ALGO_A192CBC_HS384;
30
+	}
31 31
 
32
-    /**
33
-     * {@inheritdoc}
34
-     */
35
-    protected function _cipherMethod(): string
36
-    {
37
-        return 'aes-192-cbc';
38
-    }
32
+	/**
33
+	 * {@inheritdoc}
34
+	 */
35
+	protected function _cipherMethod(): string
36
+	{
37
+		return 'aes-192-cbc';
38
+	}
39 39
 
40
-    /**
41
-     * {@inheritdoc}
42
-     */
43
-    protected function _hashAlgo(): string
44
-    {
45
-        return 'sha384';
46
-    }
40
+	/**
41
+	 * {@inheritdoc}
42
+	 */
43
+	protected function _hashAlgo(): string
44
+	{
45
+		return 'sha384';
46
+	}
47 47
 
48
-    /**
49
-     * {@inheritdoc}
50
-     */
51
-    protected function _encKeyLen(): int
52
-    {
53
-        return 24;
54
-    }
48
+	/**
49
+	 * {@inheritdoc}
50
+	 */
51
+	protected function _encKeyLen(): int
52
+	{
53
+		return 24;
54
+	}
55 55
 
56
-    /**
57
-     * {@inheritdoc}
58
-     */
59
-    protected function _macKeyLen(): int
60
-    {
61
-        return 24;
62
-    }
56
+	/**
57
+	 * {@inheritdoc}
58
+	 */
59
+	protected function _macKeyLen(): int
60
+	{
61
+		return 24;
62
+	}
63 63
 
64
-    /**
65
-     * {@inheritdoc}
66
-     */
67
-    protected function _tagLen(): int
68
-    {
69
-        return 24;
70
-    }
64
+	/**
65
+	 * {@inheritdoc}
66
+	 */
67
+	protected function _tagLen(): int
68
+	{
69
+		return 24;
70
+	}
71 71
 }
Please login to merge, or discard this patch.
Spacing   +1 added lines, -1 removed lines patch added patch discarded remove patch
@@ -1,6 +1,6 @@
 block discarded – undo
1 1
 <?php
2 2
 
3
-declare(strict_types = 1);
3
+declare(strict_types=1);
4 4
 
5 5
 namespace Sop\JWX\JWE\EncryptionAlgorithm;
6 6
 
Please login to merge, or discard this patch.
lib/JWX/JWE/EncryptionAlgorithm/EncryptionAlgorithmFactory.php 2 patches
Indentation   +52 added lines, -52 removed lines patch added patch discarded remove patch
@@ -13,58 +13,58 @@
 block discarded – undo
13 13
  */
14 14
 abstract class EncryptionAlgorithmFactory
15 15
 {
16
-    /**
17
-     * Mapping from algorithm name to class name.
18
-     *
19
-     * @internal
20
-     *
21
-     * @var array
22
-     */
23
-    const MAP_ALGO_TO_CLASS = [
24
-        JWA::ALGO_A128CBC_HS256 => A128CBCHS256Algorithm::class,
25
-        JWA::ALGO_A192CBC_HS384 => A192CBCHS384Algorithm::class,
26
-        JWA::ALGO_A256CBC_HS512 => A256CBCHS512Algorithm::class,
27
-        JWA::ALGO_A128GCM => A128GCMAlgorithm::class,
28
-        JWA::ALGO_A192GCM => A192GCMAlgorithm::class,
29
-        JWA::ALGO_A256GCM => A256GCMAlgorithm::class,
30
-    ];
16
+	/**
17
+	 * Mapping from algorithm name to class name.
18
+	 *
19
+	 * @internal
20
+	 *
21
+	 * @var array
22
+	 */
23
+	const MAP_ALGO_TO_CLASS = [
24
+		JWA::ALGO_A128CBC_HS256 => A128CBCHS256Algorithm::class,
25
+		JWA::ALGO_A192CBC_HS384 => A192CBCHS384Algorithm::class,
26
+		JWA::ALGO_A256CBC_HS512 => A256CBCHS512Algorithm::class,
27
+		JWA::ALGO_A128GCM => A128GCMAlgorithm::class,
28
+		JWA::ALGO_A192GCM => A192GCMAlgorithm::class,
29
+		JWA::ALGO_A256GCM => A256GCMAlgorithm::class,
30
+	];
31 31
 
32
-    /**
33
-     * Get the content encryption algorithm by algorithm name.
34
-     *
35
-     * @param string $name Algorithm name
36
-     *
37
-     * @throws \UnexpectedValueException if algorithm is not supported
38
-     *
39
-     * @return ContentEncryptionAlgorithm
40
-     */
41
-    public static function algoByName(string $name): ContentEncryptionAlgorithm
42
-    {
43
-        if (!array_key_exists($name, self::MAP_ALGO_TO_CLASS)) {
44
-            throw new \UnexpectedValueException(
45
-                "No content encryption algorithm '{$name}'.");
46
-        }
47
-        $cls = self::MAP_ALGO_TO_CLASS[$name];
48
-        return new $cls();
49
-    }
32
+	/**
33
+	 * Get the content encryption algorithm by algorithm name.
34
+	 *
35
+	 * @param string $name Algorithm name
36
+	 *
37
+	 * @throws \UnexpectedValueException if algorithm is not supported
38
+	 *
39
+	 * @return ContentEncryptionAlgorithm
40
+	 */
41
+	public static function algoByName(string $name): ContentEncryptionAlgorithm
42
+	{
43
+		if (!array_key_exists($name, self::MAP_ALGO_TO_CLASS)) {
44
+			throw new \UnexpectedValueException(
45
+				"No content encryption algorithm '{$name}'.");
46
+		}
47
+		$cls = self::MAP_ALGO_TO_CLASS[$name];
48
+		return new $cls();
49
+	}
50 50
 
51
-    /**
52
-     * Get the content encryption algorithm as specified in the given header.
53
-     *
54
-     * @param Header $header Header
55
-     *
56
-     * @throws \UnexpectedValueException If content encryption algorithm
57
-     *                                   parameter is not present or algorithm
58
-     *                                   is not supported
59
-     *
60
-     * @return ContentEncryptionAlgorithm
61
-     */
62
-    public static function algoByHeader(Header $header): ContentEncryptionAlgorithm
63
-    {
64
-        if (!$header->hasEncryptionAlgorithm()) {
65
-            throw new \UnexpectedValueException(
66
-                'No encryption algorithm parameter.');
67
-        }
68
-        return self::algoByName($header->encryptionAlgorithm()->value());
69
-    }
51
+	/**
52
+	 * Get the content encryption algorithm as specified in the given header.
53
+	 *
54
+	 * @param Header $header Header
55
+	 *
56
+	 * @throws \UnexpectedValueException If content encryption algorithm
57
+	 *                                   parameter is not present or algorithm
58
+	 *                                   is not supported
59
+	 *
60
+	 * @return ContentEncryptionAlgorithm
61
+	 */
62
+	public static function algoByHeader(Header $header): ContentEncryptionAlgorithm
63
+	{
64
+		if (!$header->hasEncryptionAlgorithm()) {
65
+			throw new \UnexpectedValueException(
66
+				'No encryption algorithm parameter.');
67
+		}
68
+		return self::algoByName($header->encryptionAlgorithm()->value());
69
+	}
70 70
 }
Please login to merge, or discard this patch.
Spacing   +1 added lines, -1 removed lines patch added patch discarded remove patch
@@ -1,6 +1,6 @@
 block discarded – undo
1 1
 <?php
2 2
 
3
-declare(strict_types = 1);
3
+declare(strict_types=1);
4 4
 
5 5
 namespace Sop\JWX\JWE\EncryptionAlgorithm;
6 6
 
Please login to merge, or discard this patch.
lib/JWX/JWE/EncryptionAlgorithm/AESCBCAlgorithm.php 2 patches
Indentation   +210 added lines, -210 removed lines patch added patch discarded remove patch
@@ -15,214 +15,214 @@
 block discarded – undo
15 15
  */
16 16
 abstract class AESCBCAlgorithm implements ContentEncryptionAlgorithm
17 17
 {
18
-    /**
19
-     * {@inheritdoc}
20
-     */
21
-    public function encrypt(string $plaintext, string $key, string $iv,
22
-        string $aad): array
23
-    {
24
-        $this->_validateKey($key);
25
-        $this->_validateIV($iv);
26
-        $ciphertext = openssl_encrypt($plaintext, $this->_getCipherMethod(),
27
-            $this->_encKey($key), OPENSSL_RAW_DATA, $iv);
28
-        if (false === $ciphertext) {
29
-            throw new \RuntimeException(
30
-                'openssl_encrypt() failed: ' . $this->_getLastOpenSSLError());
31
-        }
32
-        $auth_data = $aad . $iv . $ciphertext . $this->_aadLen($aad);
33
-        $auth_tag = $this->_computeAuthTag($auth_data, $key);
34
-        return [$ciphertext, $auth_tag];
35
-    }
36
-
37
-    /**
38
-     * {@inheritdoc}
39
-     */
40
-    public function decrypt(string $ciphertext, string $key, string $iv,
41
-        string $aad, string $auth_tag): string
42
-    {
43
-        $this->_validateKey($key);
44
-        $this->_validateIV($iv);
45
-        $auth_data = $aad . $iv . $ciphertext . $this->_aadLen($aad);
46
-        if ($this->_computeAuthTag($auth_data, $key) !== $auth_tag) {
47
-            throw new AuthenticationException('Message authentication failed.');
48
-        }
49
-        $plaintext = openssl_decrypt($ciphertext, $this->_getCipherMethod(),
50
-            $this->_encKey($key), OPENSSL_RAW_DATA, $iv);
51
-        if (false === $plaintext) {
52
-            throw new \RuntimeException(
53
-                'openssl_decrypt() failed: ' . $this->_getLastOpenSSLError());
54
-        }
55
-        return $plaintext;
56
-    }
57
-
58
-    /**
59
-     * {@inheritdoc}
60
-     */
61
-    public function ivSize(): int
62
-    {
63
-        return 16;
64
-    }
65
-
66
-    /**
67
-     * {@inheritdoc}
68
-     */
69
-    public function headerParameters(): array
70
-    {
71
-        return [EncryptionAlgorithmParameter::fromAlgorithm($this)];
72
-    }
73
-
74
-    /**
75
-     * Get cipher method name that is recognized by OpenSSL.
76
-     *
77
-     * @return string
78
-     */
79
-    abstract protected function _cipherMethod(): string;
80
-
81
-    /**
82
-     * Get algorithm name that is recognized by the Hash extension.
83
-     *
84
-     * @return string
85
-     */
86
-    abstract protected function _hashAlgo(): string;
87
-
88
-    /**
89
-     * Get length of the encryption key.
90
-     *
91
-     * @return int
92
-     */
93
-    abstract protected function _encKeyLen(): int;
94
-
95
-    /**
96
-     * Get length of the MAC key.
97
-     *
98
-     * @return int
99
-     */
100
-    abstract protected function _macKeyLen(): int;
101
-
102
-    /**
103
-     * Get length of the authentication tag.
104
-     *
105
-     * @return int
106
-     */
107
-    abstract protected function _tagLen(): int;
108
-
109
-    /**
110
-     * Get cipher method and verify that it's supported.
111
-     *
112
-     * @throws \RuntimeException
113
-     *
114
-     * @return string
115
-     */
116
-    final protected function _getCipherMethod(): string
117
-    {
118
-        static $supported_ciphers;
119
-        if (!isset($supported_ciphers)) {
120
-            $supported_ciphers = array_flip(
121
-                array_map('strtolower', openssl_get_cipher_methods(false)));
122
-        }
123
-        $method = $this->_cipherMethod();
124
-        if (!isset($supported_ciphers[$method])) {
125
-            throw new \RuntimeException(
126
-                "Cipher method {$method} is not" .
127
-                     ' supported by this version of OpenSSL.');
128
-        }
129
-        return $method;
130
-    }
131
-
132
-    /**
133
-     * Check that key is valid.
134
-     *
135
-     * @param string $key
136
-     *
137
-     * @throws \RuntimeException
138
-     */
139
-    final protected function _validateKey(string $key): void
140
-    {
141
-        if (strlen($key) !== $this->keySize()) {
142
-            throw new \RuntimeException('Invalid key size.');
143
-        }
144
-    }
145
-
146
-    /**
147
-     * Check that IV is valid.
148
-     *
149
-     * @param string $iv
150
-     *
151
-     * @throws \RuntimeException
152
-     */
153
-    final protected function _validateIV(string $iv): void
154
-    {
155
-        $len = openssl_cipher_iv_length($this->_getCipherMethod());
156
-        if ($len !== strlen($iv)) {
157
-            throw new \RuntimeException('Invalid IV length.');
158
-        }
159
-    }
160
-
161
-    /**
162
-     * Get MAC key from CEK.
163
-     *
164
-     * @param string $key
165
-     *
166
-     * @return string
167
-     */
168
-    final protected function _macKey(string $key): string
169
-    {
170
-        return substr($key, 0, $this->_macKeyLen());
171
-    }
172
-
173
-    /**
174
-     * Get encryption key from CEK.
175
-     *
176
-     * @param string $key
177
-     *
178
-     * @return string
179
-     */
180
-    final protected function _encKey(string $key): string
181
-    {
182
-        return substr($key, -$this->_encKeyLen());
183
-    }
184
-
185
-    /**
186
-     * Compute AL value.
187
-     *
188
-     * @param string $aad
189
-     *
190
-     * @return string 64 bits
191
-     */
192
-    final protected function _aadLen(string $aad): string
193
-    {
194
-        // truncate on 32 bit hosts
195
-        if (PHP_INT_SIZE < 8) {
196
-            return "\0\0\0\0" . pack('N', strlen($aad) * 8);
197
-        }
198
-        return pack('J', strlen($aad) * 8);
199
-    }
200
-
201
-    /**
202
-     * Compute authentication tag.
203
-     *
204
-     * @param string $data
205
-     * @param string $key  CEK
206
-     *
207
-     * @return string
208
-     */
209
-    final protected function _computeAuthTag(string $data, string $key): string
210
-    {
211
-        $tag = hash_hmac($this->_hashAlgo(), $data, $this->_macKey($key), true);
212
-        return substr($tag, 0, $this->_tagLen());
213
-    }
214
-
215
-    /**
216
-     * Get last OpenSSL error message.
217
-     *
218
-     * @return null|string
219
-     */
220
-    protected function _getLastOpenSSLError(): ?string
221
-    {
222
-        $msg = null;
223
-        while (false !== ($err = openssl_error_string())) {
224
-            $msg = $err;
225
-        }
226
-        return $msg;
227
-    }
18
+	/**
19
+	 * {@inheritdoc}
20
+	 */
21
+	public function encrypt(string $plaintext, string $key, string $iv,
22
+		string $aad): array
23
+	{
24
+		$this->_validateKey($key);
25
+		$this->_validateIV($iv);
26
+		$ciphertext = openssl_encrypt($plaintext, $this->_getCipherMethod(),
27
+			$this->_encKey($key), OPENSSL_RAW_DATA, $iv);
28
+		if (false === $ciphertext) {
29
+			throw new \RuntimeException(
30
+				'openssl_encrypt() failed: ' . $this->_getLastOpenSSLError());
31
+		}
32
+		$auth_data = $aad . $iv . $ciphertext . $this->_aadLen($aad);
33
+		$auth_tag = $this->_computeAuthTag($auth_data, $key);
34
+		return [$ciphertext, $auth_tag];
35
+	}
36
+
37
+	/**
38
+	 * {@inheritdoc}
39
+	 */
40
+	public function decrypt(string $ciphertext, string $key, string $iv,
41
+		string $aad, string $auth_tag): string
42
+	{
43
+		$this->_validateKey($key);
44
+		$this->_validateIV($iv);
45
+		$auth_data = $aad . $iv . $ciphertext . $this->_aadLen($aad);
46
+		if ($this->_computeAuthTag($auth_data, $key) !== $auth_tag) {
47
+			throw new AuthenticationException('Message authentication failed.');
48
+		}
49
+		$plaintext = openssl_decrypt($ciphertext, $this->_getCipherMethod(),
50
+			$this->_encKey($key), OPENSSL_RAW_DATA, $iv);
51
+		if (false === $plaintext) {
52
+			throw new \RuntimeException(
53
+				'openssl_decrypt() failed: ' . $this->_getLastOpenSSLError());
54
+		}
55
+		return $plaintext;
56
+	}
57
+
58
+	/**
59
+	 * {@inheritdoc}
60
+	 */
61
+	public function ivSize(): int
62
+	{
63
+		return 16;
64
+	}
65
+
66
+	/**
67
+	 * {@inheritdoc}
68
+	 */
69
+	public function headerParameters(): array
70
+	{
71
+		return [EncryptionAlgorithmParameter::fromAlgorithm($this)];
72
+	}
73
+
74
+	/**
75
+	 * Get cipher method name that is recognized by OpenSSL.
76
+	 *
77
+	 * @return string
78
+	 */
79
+	abstract protected function _cipherMethod(): string;
80
+
81
+	/**
82
+	 * Get algorithm name that is recognized by the Hash extension.
83
+	 *
84
+	 * @return string
85
+	 */
86
+	abstract protected function _hashAlgo(): string;
87
+
88
+	/**
89
+	 * Get length of the encryption key.
90
+	 *
91
+	 * @return int
92
+	 */
93
+	abstract protected function _encKeyLen(): int;
94
+
95
+	/**
96
+	 * Get length of the MAC key.
97
+	 *
98
+	 * @return int
99
+	 */
100
+	abstract protected function _macKeyLen(): int;
101
+
102
+	/**
103
+	 * Get length of the authentication tag.
104
+	 *
105
+	 * @return int
106
+	 */
107
+	abstract protected function _tagLen(): int;
108
+
109
+	/**
110
+	 * Get cipher method and verify that it's supported.
111
+	 *
112
+	 * @throws \RuntimeException
113
+	 *
114
+	 * @return string
115
+	 */
116
+	final protected function _getCipherMethod(): string
117
+	{
118
+		static $supported_ciphers;
119
+		if (!isset($supported_ciphers)) {
120
+			$supported_ciphers = array_flip(
121
+				array_map('strtolower', openssl_get_cipher_methods(false)));
122
+		}
123
+		$method = $this->_cipherMethod();
124
+		if (!isset($supported_ciphers[$method])) {
125
+			throw new \RuntimeException(
126
+				"Cipher method {$method} is not" .
127
+					 ' supported by this version of OpenSSL.');
128
+		}
129
+		return $method;
130
+	}
131
+
132
+	/**
133
+	 * Check that key is valid.
134
+	 *
135
+	 * @param string $key
136
+	 *
137
+	 * @throws \RuntimeException
138
+	 */
139
+	final protected function _validateKey(string $key): void
140
+	{
141
+		if (strlen($key) !== $this->keySize()) {
142
+			throw new \RuntimeException('Invalid key size.');
143
+		}
144
+	}
145
+
146
+	/**
147
+	 * Check that IV is valid.
148
+	 *
149
+	 * @param string $iv
150
+	 *
151
+	 * @throws \RuntimeException
152
+	 */
153
+	final protected function _validateIV(string $iv): void
154
+	{
155
+		$len = openssl_cipher_iv_length($this->_getCipherMethod());
156
+		if ($len !== strlen($iv)) {
157
+			throw new \RuntimeException('Invalid IV length.');
158
+		}
159
+	}
160
+
161
+	/**
162
+	 * Get MAC key from CEK.
163
+	 *
164
+	 * @param string $key
165
+	 *
166
+	 * @return string
167
+	 */
168
+	final protected function _macKey(string $key): string
169
+	{
170
+		return substr($key, 0, $this->_macKeyLen());
171
+	}
172
+
173
+	/**
174
+	 * Get encryption key from CEK.
175
+	 *
176
+	 * @param string $key
177
+	 *
178
+	 * @return string
179
+	 */
180
+	final protected function _encKey(string $key): string
181
+	{
182
+		return substr($key, -$this->_encKeyLen());
183
+	}
184
+
185
+	/**
186
+	 * Compute AL value.
187
+	 *
188
+	 * @param string $aad
189
+	 *
190
+	 * @return string 64 bits
191
+	 */
192
+	final protected function _aadLen(string $aad): string
193
+	{
194
+		// truncate on 32 bit hosts
195
+		if (PHP_INT_SIZE < 8) {
196
+			return "\0\0\0\0" . pack('N', strlen($aad) * 8);
197
+		}
198
+		return pack('J', strlen($aad) * 8);
199
+	}
200
+
201
+	/**
202
+	 * Compute authentication tag.
203
+	 *
204
+	 * @param string $data
205
+	 * @param string $key  CEK
206
+	 *
207
+	 * @return string
208
+	 */
209
+	final protected function _computeAuthTag(string $data, string $key): string
210
+	{
211
+		$tag = hash_hmac($this->_hashAlgo(), $data, $this->_macKey($key), true);
212
+		return substr($tag, 0, $this->_tagLen());
213
+	}
214
+
215
+	/**
216
+	 * Get last OpenSSL error message.
217
+	 *
218
+	 * @return null|string
219
+	 */
220
+	protected function _getLastOpenSSLError(): ?string
221
+	{
222
+		$msg = null;
223
+		while (false !== ($err = openssl_error_string())) {
224
+			$msg = $err;
225
+		}
226
+		return $msg;
227
+	}
228 228
 }
Please login to merge, or discard this patch.
Spacing   +1 added lines, -1 removed lines patch added patch discarded remove patch
@@ -1,6 +1,6 @@
 block discarded – undo
1 1
 <?php
2 2
 
3
-declare(strict_types = 1);
3
+declare(strict_types=1);
4 4
 
5 5
 namespace Sop\JWX\JWE\EncryptionAlgorithm;
6 6
 
Please login to merge, or discard this patch.
lib/JWX/JWE/EncryptionAlgorithm/A128CBCHS256Algorithm.php 2 patches
Indentation   +49 added lines, -49 removed lines patch added patch discarded remove patch
@@ -13,59 +13,59 @@
 block discarded – undo
13 13
  */
14 14
 class A128CBCHS256Algorithm extends AESCBCAlgorithm
15 15
 {
16
-    /**
17
-     * {@inheritdoc}
18
-     */
19
-    public function keySize(): int
20
-    {
21
-        return 32;
22
-    }
16
+	/**
17
+	 * {@inheritdoc}
18
+	 */
19
+	public function keySize(): int
20
+	{
21
+		return 32;
22
+	}
23 23
 
24
-    /**
25
-     * {@inheritdoc}
26
-     */
27
-    public function encryptionAlgorithmParamValue(): string
28
-    {
29
-        return JWA::ALGO_A128CBC_HS256;
30
-    }
24
+	/**
25
+	 * {@inheritdoc}
26
+	 */
27
+	public function encryptionAlgorithmParamValue(): string
28
+	{
29
+		return JWA::ALGO_A128CBC_HS256;
30
+	}
31 31
 
32
-    /**
33
-     * {@inheritdoc}
34
-     */
35
-    protected function _cipherMethod(): string
36
-    {
37
-        return 'aes-128-cbc';
38
-    }
32
+	/**
33
+	 * {@inheritdoc}
34
+	 */
35
+	protected function _cipherMethod(): string
36
+	{
37
+		return 'aes-128-cbc';
38
+	}
39 39
 
40
-    /**
41
-     * {@inheritdoc}
42
-     */
43
-    protected function _hashAlgo(): string
44
-    {
45
-        return 'sha256';
46
-    }
40
+	/**
41
+	 * {@inheritdoc}
42
+	 */
43
+	protected function _hashAlgo(): string
44
+	{
45
+		return 'sha256';
46
+	}
47 47
 
48
-    /**
49
-     * {@inheritdoc}
50
-     */
51
-    protected function _encKeyLen(): int
52
-    {
53
-        return 16;
54
-    }
48
+	/**
49
+	 * {@inheritdoc}
50
+	 */
51
+	protected function _encKeyLen(): int
52
+	{
53
+		return 16;
54
+	}
55 55
 
56
-    /**
57
-     * {@inheritdoc}
58
-     */
59
-    protected function _macKeyLen(): int
60
-    {
61
-        return 16;
62
-    }
56
+	/**
57
+	 * {@inheritdoc}
58
+	 */
59
+	protected function _macKeyLen(): int
60
+	{
61
+		return 16;
62
+	}
63 63
 
64
-    /**
65
-     * {@inheritdoc}
66
-     */
67
-    protected function _tagLen(): int
68
-    {
69
-        return 16;
70
-    }
64
+	/**
65
+	 * {@inheritdoc}
66
+	 */
67
+	protected function _tagLen(): int
68
+	{
69
+		return 16;
70
+	}
71 71
 }
Please login to merge, or discard this patch.
Spacing   +1 added lines, -1 removed lines patch added patch discarded remove patch
@@ -1,6 +1,6 @@
 block discarded – undo
1 1
 <?php
2 2
 
3
-declare(strict_types = 1);
3
+declare(strict_types=1);
4 4
 
5 5
 namespace Sop\JWX\JWE\EncryptionAlgorithm;
6 6
 
Please login to merge, or discard this patch.
lib/JWX/JWE/CompressionAlgorithm/DeflateAlgorithm.php 2 patches
Indentation   +62 added lines, -62 removed lines patch added patch discarded remove patch
@@ -16,71 +16,71 @@
 block discarded – undo
16 16
  */
17 17
 class DeflateAlgorithm implements CompressionAlgorithm
18 18
 {
19
-    /**
20
-     * Compression level.
21
-     *
22
-     * @var int
23
-     */
24
-    protected $_compressionLevel;
19
+	/**
20
+	 * Compression level.
21
+	 *
22
+	 * @var int
23
+	 */
24
+	protected $_compressionLevel;
25 25
 
26
-    /**
27
-     * Constructor.
28
-     *
29
-     * @param int $level Compression level 0..9
30
-     */
31
-    public function __construct(int $level = -1)
32
-    {
33
-        if ($level < -1 || $level > 9) {
34
-            throw new \DomainException('Compression level must be -1..9.');
35
-        }
36
-        $this->_compressionLevel = $level;
37
-    }
26
+	/**
27
+	 * Constructor.
28
+	 *
29
+	 * @param int $level Compression level 0..9
30
+	 */
31
+	public function __construct(int $level = -1)
32
+	{
33
+		if ($level < -1 || $level > 9) {
34
+			throw new \DomainException('Compression level must be -1..9.');
35
+		}
36
+		$this->_compressionLevel = $level;
37
+	}
38 38
 
39
-    /**
40
-     * {@inheritdoc}
41
-     *
42
-     * @throws \RuntimeException
43
-     */
44
-    public function compress(string $data): string
45
-    {
46
-        $ret = @gzdeflate($data, $this->_compressionLevel);
47
-        if (false === $ret) {
48
-            $err = error_get_last();
49
-            $msg = isset($err) && __FILE__ === $err['file'] ? $err['message'] : null;
50
-            throw new \RuntimeException($msg ?? 'gzdeflate() failed.');
51
-        }
52
-        return $ret;
53
-    }
39
+	/**
40
+	 * {@inheritdoc}
41
+	 *
42
+	 * @throws \RuntimeException
43
+	 */
44
+	public function compress(string $data): string
45
+	{
46
+		$ret = @gzdeflate($data, $this->_compressionLevel);
47
+		if (false === $ret) {
48
+			$err = error_get_last();
49
+			$msg = isset($err) && __FILE__ === $err['file'] ? $err['message'] : null;
50
+			throw new \RuntimeException($msg ?? 'gzdeflate() failed.');
51
+		}
52
+		return $ret;
53
+	}
54 54
 
55
-    /**
56
-     * {@inheritdoc}
57
-     *
58
-     * @throws \RuntimeException
59
-     */
60
-    public function decompress(string $data): string
61
-    {
62
-        $ret = @gzinflate($data);
63
-        if (false === $ret) {
64
-            $err = error_get_last();
65
-            $msg = isset($err) && __FILE__ === $err['file'] ? $err['message'] : null;
66
-            throw new \RuntimeException($msg ?? 'gzinflate() failed.');
67
-        }
68
-        return $ret;
69
-    }
55
+	/**
56
+	 * {@inheritdoc}
57
+	 *
58
+	 * @throws \RuntimeException
59
+	 */
60
+	public function decompress(string $data): string
61
+	{
62
+		$ret = @gzinflate($data);
63
+		if (false === $ret) {
64
+			$err = error_get_last();
65
+			$msg = isset($err) && __FILE__ === $err['file'] ? $err['message'] : null;
66
+			throw new \RuntimeException($msg ?? 'gzinflate() failed.');
67
+		}
68
+		return $ret;
69
+	}
70 70
 
71
-    /**
72
-     * {@inheritdoc}
73
-     */
74
-    public function compressionParamValue(): string
75
-    {
76
-        return JWA::ALGO_DEFLATE;
77
-    }
71
+	/**
72
+	 * {@inheritdoc}
73
+	 */
74
+	public function compressionParamValue(): string
75
+	{
76
+		return JWA::ALGO_DEFLATE;
77
+	}
78 78
 
79
-    /**
80
-     * {@inheritdoc}
81
-     */
82
-    public function headerParameters(): array
83
-    {
84
-        return [CompressionAlgorithmParameter::fromAlgorithm($this)];
85
-    }
79
+	/**
80
+	 * {@inheritdoc}
81
+	 */
82
+	public function headerParameters(): array
83
+	{
84
+		return [CompressionAlgorithmParameter::fromAlgorithm($this)];
85
+	}
86 86
 }
Please login to merge, or discard this patch.
Spacing   +1 added lines, -1 removed lines patch added patch discarded remove patch
@@ -1,6 +1,6 @@
 block discarded – undo
1 1
 <?php
2 2
 
3
-declare(strict_types = 1);
3
+declare(strict_types=1);
4 4
 
5 5
 namespace Sop\JWX\JWE\CompressionAlgorithm;
6 6
 
Please login to merge, or discard this patch.
lib/JWX/JWE/CompressionAlgorithm/CompressionFactory.php 2 patches
Indentation   +46 added lines, -46 removed lines patch added patch discarded remove patch
@@ -13,52 +13,52 @@
 block discarded – undo
13 13
  */
14 14
 abstract class CompressionFactory
15 15
 {
16
-    /**
17
-     * Mapping from algorithm name to class name.
18
-     *
19
-     * @internal
20
-     *
21
-     * @var array
22
-     */
23
-    const MAP_ALGO_TO_CLASS = [
24
-        JWA::ALGO_DEFLATE => DeflateAlgorithm::class,
25
-    ];
16
+	/**
17
+	 * Mapping from algorithm name to class name.
18
+	 *
19
+	 * @internal
20
+	 *
21
+	 * @var array
22
+	 */
23
+	const MAP_ALGO_TO_CLASS = [
24
+		JWA::ALGO_DEFLATE => DeflateAlgorithm::class,
25
+	];
26 26
 
27
-    /**
28
-     * Get the compression algorithm by name.
29
-     *
30
-     * @param string $name
31
-     *
32
-     * @throws \UnexpectedValueException If algorithm is not supported
33
-     *
34
-     * @return CompressionAlgorithm
35
-     */
36
-    public static function algoByName(string $name): CompressionAlgorithm
37
-    {
38
-        if (!array_key_exists($name, self::MAP_ALGO_TO_CLASS)) {
39
-            throw new \UnexpectedValueException(
40
-                "No compression algorithm '{$name}'.");
41
-        }
42
-        $cls = self::MAP_ALGO_TO_CLASS[$name];
43
-        return new $cls();
44
-    }
27
+	/**
28
+	 * Get the compression algorithm by name.
29
+	 *
30
+	 * @param string $name
31
+	 *
32
+	 * @throws \UnexpectedValueException If algorithm is not supported
33
+	 *
34
+	 * @return CompressionAlgorithm
35
+	 */
36
+	public static function algoByName(string $name): CompressionAlgorithm
37
+	{
38
+		if (!array_key_exists($name, self::MAP_ALGO_TO_CLASS)) {
39
+			throw new \UnexpectedValueException(
40
+				"No compression algorithm '{$name}'.");
41
+		}
42
+		$cls = self::MAP_ALGO_TO_CLASS[$name];
43
+		return new $cls();
44
+	}
45 45
 
46
-    /**
47
-     * Get the compression algorithm as specified in the given header.
48
-     *
49
-     * @param Header $header Header
50
-     *
51
-     * @throws \UnexpectedValueException If compression algorithm parameter is
52
-     *                                   not present or algorithm is not supported
53
-     *
54
-     * @return CompressionAlgorithm
55
-     */
56
-    public static function algoByHeader(Header $header): CompressionAlgorithm
57
-    {
58
-        if (!$header->hasCompressionAlgorithm()) {
59
-            throw new \UnexpectedValueException(
60
-                'No compression algorithm parameter.');
61
-        }
62
-        return self::algoByName($header->compressionAlgorithm()->value());
63
-    }
46
+	/**
47
+	 * Get the compression algorithm as specified in the given header.
48
+	 *
49
+	 * @param Header $header Header
50
+	 *
51
+	 * @throws \UnexpectedValueException If compression algorithm parameter is
52
+	 *                                   not present or algorithm is not supported
53
+	 *
54
+	 * @return CompressionAlgorithm
55
+	 */
56
+	public static function algoByHeader(Header $header): CompressionAlgorithm
57
+	{
58
+		if (!$header->hasCompressionAlgorithm()) {
59
+			throw new \UnexpectedValueException(
60
+				'No compression algorithm parameter.');
61
+		}
62
+		return self::algoByName($header->compressionAlgorithm()->value());
63
+	}
64 64
 }
Please login to merge, or discard this patch.
Spacing   +1 added lines, -1 removed lines patch added patch discarded remove patch
@@ -1,6 +1,6 @@
 block discarded – undo
1 1
 <?php
2 2
 
3
-declare(strict_types = 1);
3
+declare(strict_types=1);
4 4
 
5 5
 namespace Sop\JWX\JWE\CompressionAlgorithm;
6 6
 
Please login to merge, or discard this patch.