sop / jwx

lib/JWX/JWE/Exception/AuthenticationException.php

Spacing +1 added lines, -1 removed lines

@@ -1,6 +1,6 @@
 <?php
 
-declare(strict_types = 1);
+declare(strict_types=1);
 
 namespace Sop\JWX\JWE\Exception;
 

lib/JWX/JWE/ContentEncryptionAlgorithm.php

Indentation +37 added lines, -37 removed lines

@@ -12,44 +12,44 @@
  */
 interface ContentEncryptionAlgorithm extends EncryptionAlgorithmParameterValue, HeaderParameters
 {
-    /**
-     * Encrypt plaintext.
-     *
-     * @param string $plaintext Data to encrypt
-     * @param string $key       Encryption key
-     * @param string $iv        Initialization vector
-     * @param string $aad       Additional authenticated data
-     *
-     * @return array Tuple of ciphertext and authentication tag
-     */
-    public function encrypt(string $plaintext, string $key, string $iv,
-        string $aad): array;
+	/**
+	 * Encrypt plaintext.
+	 *
+	 * @param string $plaintext Data to encrypt
+	 * @param string $key       Encryption key
+	 * @param string $iv        Initialization vector
+	 * @param string $aad       Additional authenticated data
+	 *
+	 * @return array Tuple of ciphertext and authentication tag
+	 */
+	public function encrypt(string $plaintext, string $key, string $iv,
+		string $aad): array;
 
-    /**
-     * Decrypt ciphertext.
-     *
-     * @param string $ciphertext Data to decrypt
-     * @param string $key        Encryption key
-     * @param string $iv         Initialization vector
-     * @param string $aad        Additional authenticated data
-     * @param string $auth_tag   Authentication tag to compare
-     *
-     * @return string Plaintext
-     */
-    public function decrypt(string $ciphertext, string $key, string $iv,
-        string $aad, string $auth_tag): string;
+	/**
+	 * Decrypt ciphertext.
+	 *
+	 * @param string $ciphertext Data to decrypt
+	 * @param string $key        Encryption key
+	 * @param string $iv         Initialization vector
+	 * @param string $aad        Additional authenticated data
+	 * @param string $auth_tag   Authentication tag to compare
+	 *
+	 * @return string Plaintext
+	 */
+	public function decrypt(string $ciphertext, string $key, string $iv,
+		string $aad, string $auth_tag): string;
 
-    /**
-     * Get the required key size in bytes.
-     *
-     * @return int
-     */
-    public function keySize(): int;
+	/**
+	 * Get the required key size in bytes.
+	 *
+	 * @return int
+	 */
+	public function keySize(): int;
 
-    /**
-     * Get the required IV size in bytes.
-     *
-     * @return int
-     */
-    public function ivSize(): int;
+	/**
+	 * Get the required IV size in bytes.
+	 *
+	 * @return int
+	 */
+	public function ivSize(): int;
 }

Spacing +1 added lines, -1 removed lines

@@ -1,6 +1,6 @@
 <?php
 
-declare(strict_types = 1);
+declare(strict_types=1);
 
 namespace Sop\JWX\JWE;
 

lib/JWX/JWE/KeyAlgorithm/PBES2Algorithm.php

Indentation +195 added lines, -195 removed lines

@@ -22,199 +22,199 @@
  */
 abstract class PBES2Algorithm extends KeyManagementAlgorithm
 {
-    use RandomCEK;
-
-    /**
-     * Mapping from algorithm name to class name.
-     *
-     * @internal
-     *
-     * @var array
-     */
-    const MAP_ALGO_TO_CLASS = [
-        JWA::ALGO_PBES2_HS256_A128KW => PBES2HS256A128KWAlgorithm::class,
-        JWA::ALGO_PBES2_HS384_A192KW => PBES2HS384A192KWAlgorithm::class,
-        JWA::ALGO_PBES2_HS512_A256KW => PBES2HS512A256KWAlgorithm::class,
-    ];
-
-    /**
-     * Password.
-     *
-     * @var string
-     */
-    protected $_password;
-
-    /**
-     * Salt input.
-     *
-     * @var string
-     */
-    protected $_saltInput;
-
-    /**
-     * Iteration count.
-     *
-     * @var int
-     */
-    protected $_count;
-
-    /**
-     * Derived key.
-     *
-     * @var string
-     */
-    private $_derivedKey;
-
-    /**
-     * Constructor.
-     *
-     * @param string $password   Password
-     * @param string $salt_input Salt input
-     * @param int    $count      Iteration count
-     */
-    public function __construct(string $password, string $salt_input, int $count)
-    {
-        $this->_password = $password;
-        $this->_saltInput = $salt_input;
-        $this->_count = $count;
-    }
-
-    /**
-     * Initialize from JWK.
-     *
-     * @param JWK    $jwk
-     * @param Header $header
-     *
-     * @throws \UnexpectedValueException
-     *
-     * @return self
-     */
-    public static function fromJWK(JWK $jwk, Header $header): KeyManagementAlgorithm
-    {
-        $jwk = SymmetricKeyJWK::fromJWK($jwk);
-        if (!$header->hasPBES2SaltInput()) {
-            throw new \UnexpectedValueException('No salt input.');
-        }
-        $salt_input = $header->PBES2SaltInput()->saltInput();
-        if (!$header->hasPBES2Count()) {
-            throw new \UnexpectedValueException('No iteration count.');
-        }
-        $count = $header->PBES2Count()->value();
-        $alg = JWA::deriveAlgorithmName($header, $jwk);
-        if (!array_key_exists($alg, self::MAP_ALGO_TO_CLASS)) {
-            throw new \UnexpectedValueException("Unsupported algorithm '{$alg}'.");
-        }
-        $cls = self::MAP_ALGO_TO_CLASS[$alg];
-        return new $cls($jwk->key(), $salt_input, $count);
-    }
-
-    /**
-     * Initialize from a password with random salt and default iteration count.
-     *
-     * @param string $password   Password
-     * @param int    $count      Optional user defined iteration count
-     * @param int    $salt_bytes Optional user defined salt length
-     *
-     * @return self
-     */
-    public static function fromPassword(string $password, int $count = 64000,
-        int $salt_bytes = 8): self
-    {
-        $salt_input = openssl_random_pseudo_bytes($salt_bytes);
-        return new static($password, $salt_input, $count);
-    }
-
-    /**
-     * Get salt input.
-     *
-     * @return string
-     */
-    public function saltInput(): string
-    {
-        return $this->_saltInput;
-    }
-
-    /**
-     * Get computed salt.
-     *
-     * @return string
-     */
-    public function salt(): string
-    {
-        return PBES2SaltInputParameter::fromString($this->_saltInput)->salt(
-            AlgorithmParameter::fromAlgorithm($this));
-    }
-
-    /**
-     * Get iteration count.
-     *
-     * @return int
-     */
-    public function iterationCount(): int
-    {
-        return $this->_count;
-    }
-
-    /**
-     * {@inheritdoc}
-     */
-    public function headerParameters(): array
-    {
-        return array_merge(parent::headerParameters(),
-            [AlgorithmParameter::fromAlgorithm($this),
-                PBES2SaltInputParameter::fromString($this->_saltInput),
-                new PBES2CountParameter($this->_count), ]);
-    }
-
-    /**
-     * Get hash algorithm for hash_pbkdf2.
-     *
-     * @return string
-     */
-    abstract protected function _hashAlgo(): string;
-
-    /**
-     * Get derived key length.
-     *
-     * @return int
-     */
-    abstract protected function _keyLength(): int;
-
-    /**
-     * Get key wrapping algoritym.
-     *
-     * @return AESKeyWrapAlgorithm
-     */
-    abstract protected function _kwAlgo(): AESKeyWrapAlgorithm;
-
-    /**
-     * Get derived key.
-     *
-     * @return string
-     */
-    protected function _derivedKey(): string
-    {
-        if (!isset($this->_derivedKey)) {
-            $this->_derivedKey = hash_pbkdf2($this->_hashAlgo(),
-                $this->_password, $this->salt(), $this->_count,
-                $this->_keyLength(), true);
-        }
-        return $this->_derivedKey;
-    }
-
-    /**
-     * {@inheritdoc}
-     */
-    protected function _encryptKey(string $key, Header &$header): string
-    {
-        return $this->_kwAlgo()->wrap($key, $this->_derivedKey());
-    }
-
-    /**
-     * {@inheritdoc}
-     */
-    protected function _decryptKey(string $ciphertext, Header $header): string
-    {
-        return $this->_kwAlgo()->unwrap($ciphertext, $this->_derivedKey());
-    }
+	use RandomCEK;
+
+	/**
+	 * Mapping from algorithm name to class name.
+	 *
+	 * @internal
+	 *
+	 * @var array
+	 */
+	const MAP_ALGO_TO_CLASS = [
+		JWA::ALGO_PBES2_HS256_A128KW => PBES2HS256A128KWAlgorithm::class,
+		JWA::ALGO_PBES2_HS384_A192KW => PBES2HS384A192KWAlgorithm::class,
+		JWA::ALGO_PBES2_HS512_A256KW => PBES2HS512A256KWAlgorithm::class,
+	];
+
+	/**
+	 * Password.
+	 *
+	 * @var string
+	 */
+	protected $_password;
+
+	/**
+	 * Salt input.
+	 *
+	 * @var string
+	 */
+	protected $_saltInput;
+
+	/**
+	 * Iteration count.
+	 *
+	 * @var int
+	 */
+	protected $_count;
+
+	/**
+	 * Derived key.
+	 *
+	 * @var string
+	 */
+	private $_derivedKey;
+
+	/**
+	 * Constructor.
+	 *
+	 * @param string $password   Password
+	 * @param string $salt_input Salt input
+	 * @param int    $count      Iteration count
+	 */
+	public function __construct(string $password, string $salt_input, int $count)
+	{
+		$this->_password = $password;
+		$this->_saltInput = $salt_input;
+		$this->_count = $count;
+	}
+
+	/**
+	 * Initialize from JWK.
+	 *
+	 * @param JWK    $jwk
+	 * @param Header $header
+	 *
+	 * @throws \UnexpectedValueException
+	 *
+	 * @return self
+	 */
+	public static function fromJWK(JWK $jwk, Header $header): KeyManagementAlgorithm
+	{
+		$jwk = SymmetricKeyJWK::fromJWK($jwk);
+		if (!$header->hasPBES2SaltInput()) {
+			throw new \UnexpectedValueException('No salt input.');
+		}
+		$salt_input = $header->PBES2SaltInput()->saltInput();
+		if (!$header->hasPBES2Count()) {
+			throw new \UnexpectedValueException('No iteration count.');
+		}
+		$count = $header->PBES2Count()->value();
+		$alg = JWA::deriveAlgorithmName($header, $jwk);
+		if (!array_key_exists($alg, self::MAP_ALGO_TO_CLASS)) {
+			throw new \UnexpectedValueException("Unsupported algorithm '{$alg}'.");
+		}
+		$cls = self::MAP_ALGO_TO_CLASS[$alg];
+		return new $cls($jwk->key(), $salt_input, $count);
+	}
+
+	/**
+	 * Initialize from a password with random salt and default iteration count.
+	 *
+	 * @param string $password   Password
+	 * @param int    $count      Optional user defined iteration count
+	 * @param int    $salt_bytes Optional user defined salt length
+	 *
+	 * @return self
+	 */
+	public static function fromPassword(string $password, int $count = 64000,
+		int $salt_bytes = 8): self
+	{
+		$salt_input = openssl_random_pseudo_bytes($salt_bytes);
+		return new static($password, $salt_input, $count);
+	}
+
+	/**
+	 * Get salt input.
+	 *
+	 * @return string
+	 */
+	public function saltInput(): string
+	{
+		return $this->_saltInput;
+	}
+
+	/**
+	 * Get computed salt.
+	 *
+	 * @return string
+	 */
+	public function salt(): string
+	{
+		return PBES2SaltInputParameter::fromString($this->_saltInput)->salt(
+			AlgorithmParameter::fromAlgorithm($this));
+	}
+
+	/**
+	 * Get iteration count.
+	 *
+	 * @return int
+	 */
+	public function iterationCount(): int
+	{
+		return $this->_count;
+	}
+
+	/**
+	 * {@inheritdoc}
+	 */
+	public function headerParameters(): array
+	{
+		return array_merge(parent::headerParameters(),
+			[AlgorithmParameter::fromAlgorithm($this),
+				PBES2SaltInputParameter::fromString($this->_saltInput),
+				new PBES2CountParameter($this->_count), ]);
+	}
+
+	/**
+	 * Get hash algorithm for hash_pbkdf2.
+	 *
+	 * @return string
+	 */
+	abstract protected function _hashAlgo(): string;
+
+	/**
+	 * Get derived key length.
+	 *
+	 * @return int
+	 */
+	abstract protected function _keyLength(): int;
+
+	/**
+	 * Get key wrapping algoritym.
+	 *
+	 * @return AESKeyWrapAlgorithm
+	 */
+	abstract protected function _kwAlgo(): AESKeyWrapAlgorithm;
+
+	/**
+	 * Get derived key.
+	 *
+	 * @return string
+	 */
+	protected function _derivedKey(): string
+	{
+		if (!isset($this->_derivedKey)) {
+			$this->_derivedKey = hash_pbkdf2($this->_hashAlgo(),
+				$this->_password, $this->salt(), $this->_count,
+				$this->_keyLength(), true);
+		}
+		return $this->_derivedKey;
+	}
+
+	/**
+	 * {@inheritdoc}
+	 */
+	protected function _encryptKey(string $key, Header &$header): string
+	{
+		return $this->_kwAlgo()->wrap($key, $this->_derivedKey());
+	}
+
+	/**
+	 * {@inheritdoc}
+	 */
+	protected function _decryptKey(string $ciphertext, Header $header): string
+	{
+		return $this->_kwAlgo()->unwrap($ciphertext, $this->_derivedKey());
+	}
 }

Spacing +1 added lines, -1 removed lines

@@ -1,6 +1,6 @@
 <?php
 
-declare(strict_types = 1);
+declare(strict_types=1);
 
 namespace Sop\JWX\JWE\KeyAlgorithm;
 

lib/JWX/JWE/KeyAlgorithm/A192GCMKWAlgorithm.php

Indentation +21 added lines, -21 removed lines

@@ -15,27 +15,27 @@
  */
 class A192GCMKWAlgorithm extends AESGCMKWAlgorithm
 {
-    /**
-     * {@inheritdoc}
-     */
-    public function algorithmParamValue(): string
-    {
-        return JWA::ALGO_A192GCMKW;
-    }
+	/**
+	 * {@inheritdoc}
+	 */
+	public function algorithmParamValue(): string
+	{
+		return JWA::ALGO_A192GCMKW;
+	}
 
-    /**
-     * {@inheritdoc}
-     */
-    protected function _getGCMCipher(): Cipher
-    {
-        return new AES192Cipher();
-    }
+	/**
+	 * {@inheritdoc}
+	 */
+	protected function _getGCMCipher(): Cipher
+	{
+		return new AES192Cipher();
+	}
 
-    /**
-     * {@inheritdoc}
-     */
-    protected function _keySize(): int
-    {
-        return 24;
-    }
+	/**
+	 * {@inheritdoc}
+	 */
+	protected function _keySize(): int
+	{
+		return 24;
+	}
 }

Spacing +1 added lines, -1 removed lines

@@ -1,6 +1,6 @@
 <?php
 
-declare(strict_types = 1);
+declare(strict_types=1);
 
 namespace Sop\JWX\JWE\KeyAlgorithm;
 

lib/JWX/JWE/KeyAlgorithm/PBES2HS256A128KWAlgorithm.php

Indentation +28 added lines, -28 removed lines

@@ -15,35 +15,35 @@
  */
 class PBES2HS256A128KWAlgorithm extends PBES2Algorithm
 {
-    /**
-     * {@inheritdoc}
-     */
-    public function algorithmParamValue(): string
-    {
-        return JWA::ALGO_PBES2_HS256_A128KW;
-    }
+	/**
+	 * {@inheritdoc}
+	 */
+	public function algorithmParamValue(): string
+	{
+		return JWA::ALGO_PBES2_HS256_A128KW;
+	}
 
-    /**
-     * {@inheritdoc}
-     */
-    protected function _hashAlgo(): string
-    {
-        return 'sha256';
-    }
+	/**
+	 * {@inheritdoc}
+	 */
+	protected function _hashAlgo(): string
+	{
+		return 'sha256';
+	}
 
-    /**
-     * {@inheritdoc}
-     */
-    protected function _keyLength(): int
-    {
-        return 16;
-    }
+	/**
+	 * {@inheritdoc}
+	 */
+	protected function _keyLength(): int
+	{
+		return 16;
+	}
 
-    /**
-     * {@inheritdoc}
-     */
-    protected function _kwAlgo(): AESKeyWrapAlgorithm
-    {
-        return new AESKW128();
-    }
+	/**
+	 * {@inheritdoc}
+	 */
+	protected function _kwAlgo(): AESKeyWrapAlgorithm
+	{
+		return new AESKW128();
+	}
 }

Spacing +1 added lines, -1 removed lines

@@ -1,6 +1,6 @@
 <?php
 
-declare(strict_types = 1);
+declare(strict_types=1);
 
 namespace Sop\JWX\JWE\KeyAlgorithm;
 

lib/JWX/JWE/KeyAlgorithm/Feature/RandomCEK.php

Indentation +17 added lines, -17 removed lines

@@ -9,21 +9,21 @@
  */
 trait RandomCEK
 {
-    /**
-     * Generate a random content encryption key.
-     *
-     * @param int $length Key length in bytes
-     *
-     * @throws \RuntimeException
-     *
-     * @return string
-     */
-    public function cekForEncryption(int $length): string
-    {
-        $ret = openssl_random_pseudo_bytes($length);
-        if (false === $ret) {
-            throw new \RuntimeException('openssl_random_pseudo_bytes() failed.');
-        }
-        return $ret;
-    }
+	/**
+	 * Generate a random content encryption key.
+	 *
+	 * @param int $length Key length in bytes
+	 *
+	 * @throws \RuntimeException
+	 *
+	 * @return string
+	 */
+	public function cekForEncryption(int $length): string
+	{
+		$ret = openssl_random_pseudo_bytes($length);
+		if (false === $ret) {
+			throw new \RuntimeException('openssl_random_pseudo_bytes() failed.');
+		}
+		return $ret;
+	}
 }

Spacing +1 added lines, -1 removed lines

@@ -1,6 +1,6 @@
 <?php
 
-declare(strict_types = 1);
+declare(strict_types=1);
 
 namespace Sop\JWX\JWE\KeyAlgorithm\Feature;
 

lib/JWX/JWE/KeyAlgorithm/AESGCMKWAlgorithm.php

Indentation +161 added lines, -161 removed lines

@@ -23,165 +23,165 @@
  */
 abstract class AESGCMKWAlgorithm extends KeyManagementAlgorithm
 {
-    use RandomCEK;
-
-    /**
-     * Mapping from algorithm name to class name.
-     *
-     * @internal
-     *
-     * @var array
-     */
-    const MAP_ALGO_TO_CLASS = [
-        JWA::ALGO_A128GCMKW => A128GCMKWAlgorithm::class,
-        JWA::ALGO_A192GCMKW => A192GCMKWAlgorithm::class,
-        JWA::ALGO_A256GCMKW => A256GCMKWAlgorithm::class,
-    ];
-
-    /**
-     * Required IV size in bytes.
-     *
-     * @var int
-     */
-    const IV_SIZE = 12;
-
-    /**
-     * Authentication tag size in bytes.
-     *
-     * @var int
-     */
-    const AUTH_TAG_SIZE = 16;
-
-    /**
-     * Key encryption key.
-     *
-     * @var string
-     */
-    protected $_kek;
-
-    /**
-     * Initialization vector.
-     *
-     * @var string
-     */
-    protected $_iv;
-
-    /**
-     * Constructor.
-     *
-     * @param string $kek Key encryption key
-     * @param string $iv  Initialization vector
-     */
-    public function __construct(string $kek, string $iv)
-    {
-        if (strlen($kek) !== $this->_keySize()) {
-            throw new \LengthException('Invalid key size.');
-        }
-        if (self::IV_SIZE !== strlen($iv)) {
-            throw new \LengthException('Initialization vector must be 96 bits.');
-        }
-        $this->_kek = $kek;
-        $this->_iv = $iv;
-    }
-
-    /**
-     * Initialize from JWK.
-     *
-     * @param JWK    $jwk
-     * @param Header $header
-     *
-     * @throws \UnexpectedValueException
-     *
-     * @return self
-     */
-    public static function fromJWK(JWK $jwk, Header $header): KeyManagementAlgorithm
-    {
-        $jwk = SymmetricKeyJWK::fromJWK($jwk);
-        if (!$header->hasInitializationVector()) {
-            throw new \UnexpectedValueException('No initialization vector.');
-        }
-        $iv = $header->initializationVector()->initializationVector();
-        $alg = JWA::deriveAlgorithmName($header, $jwk);
-        if (!array_key_exists($alg, self::MAP_ALGO_TO_CLASS)) {
-            throw new \UnexpectedValueException("Unsupported algorithm '{$alg}'.");
-        }
-        $cls = self::MAP_ALGO_TO_CLASS[$alg];
-        return new $cls($jwk->key(), $iv);
-    }
-
-    /**
-     * Initialize from key encryption key with random IV.
-     *
-     * Key size must match the underlying cipher.
-     *
-     * @param string $key Key encryption key
-     *
-     * @return self
-     */
-    public static function fromKey(string $key): self
-    {
-        $iv = openssl_random_pseudo_bytes(self::IV_SIZE);
-        return new static($key, $iv);
-    }
-
-    /**
-     * {@inheritdoc}
-     */
-    public function headerParameters(): array
-    {
-        return array_merge(parent::headerParameters(),
-            [AlgorithmParameter::fromAlgorithm($this),
-                InitializationVectorParameter::fromString($this->_iv), ]);
-    }
-
-    /**
-     * Get GCM Cipher instance.
-     *
-     * @return Cipher
-     */
-    abstract protected function _getGCMCipher(): Cipher;
-
-    /**
-     * Get the required key size.
-     *
-     * @return int
-     */
-    abstract protected function _keySize(): int;
-
-    /**
-     * Get GCM instance.
-     *
-     * @return GCM
-     */
-    final protected function _getGCM(): GCM
-    {
-        return new GCM($this->_getGCMCipher(), self::AUTH_TAG_SIZE);
-    }
-
-    /**
-     * {@inheritdoc}
-     */
-    protected function _encryptKey(string $key, Header &$header): string
-    {
-        [$ciphertext, $auth_tag] = $this->_getGCM()
-            ->encrypt($key, '', $this->_kek, $this->_iv);
-        // insert authentication tag to the header
-        $header = $header->withParameters(
-            AuthenticationTagParameter::fromString($auth_tag));
-        return $ciphertext;
-    }
-
-    /**
-     * {@inheritdoc}
-     */
-    protected function _decryptKey(string $ciphertext, Header $header): string
-    {
-        if (!$header->hasAuthenticationTag()) {
-            throw new \RuntimeException(
-                "Header doesn't contain authentication tag.");
-        }
-        $auth_tag = $header->authenticationTag()->authenticationTag();
-        return $this->_getGCM()
-            ->decrypt($ciphertext, $auth_tag, '', $this->_kek, $this->_iv);
-    }
+	use RandomCEK;
+
+	/**
+	 * Mapping from algorithm name to class name.
+	 *
+	 * @internal
+	 *
+	 * @var array
+	 */
+	const MAP_ALGO_TO_CLASS = [
+		JWA::ALGO_A128GCMKW => A128GCMKWAlgorithm::class,
+		JWA::ALGO_A192GCMKW => A192GCMKWAlgorithm::class,
+		JWA::ALGO_A256GCMKW => A256GCMKWAlgorithm::class,
+	];
+
+	/**
+	 * Required IV size in bytes.
+	 *
+	 * @var int
+	 */
+	const IV_SIZE = 12;
+
+	/**
+	 * Authentication tag size in bytes.
+	 *
+	 * @var int
+	 */
+	const AUTH_TAG_SIZE = 16;
+
+	/**
+	 * Key encryption key.
+	 *
+	 * @var string
+	 */
+	protected $_kek;
+
+	/**
+	 * Initialization vector.
+	 *
+	 * @var string
+	 */
+	protected $_iv;
+
+	/**
+	 * Constructor.
+	 *
+	 * @param string $kek Key encryption key
+	 * @param string $iv  Initialization vector
+	 */
+	public function __construct(string $kek, string $iv)
+	{
+		if (strlen($kek) !== $this->_keySize()) {
+			throw new \LengthException('Invalid key size.');
+		}
+		if (self::IV_SIZE !== strlen($iv)) {
+			throw new \LengthException('Initialization vector must be 96 bits.');
+		}
+		$this->_kek = $kek;
+		$this->_iv = $iv;
+	}
+
+	/**
+	 * Initialize from JWK.
+	 *
+	 * @param JWK    $jwk
+	 * @param Header $header
+	 *
+	 * @throws \UnexpectedValueException
+	 *
+	 * @return self
+	 */
+	public static function fromJWK(JWK $jwk, Header $header): KeyManagementAlgorithm
+	{
+		$jwk = SymmetricKeyJWK::fromJWK($jwk);
+		if (!$header->hasInitializationVector()) {
+			throw new \UnexpectedValueException('No initialization vector.');
+		}
+		$iv = $header->initializationVector()->initializationVector();
+		$alg = JWA::deriveAlgorithmName($header, $jwk);
+		if (!array_key_exists($alg, self::MAP_ALGO_TO_CLASS)) {
+			throw new \UnexpectedValueException("Unsupported algorithm '{$alg}'.");
+		}
+		$cls = self::MAP_ALGO_TO_CLASS[$alg];
+		return new $cls($jwk->key(), $iv);
+	}
+
+	/**
+	 * Initialize from key encryption key with random IV.
+	 *
+	 * Key size must match the underlying cipher.
+	 *
+	 * @param string $key Key encryption key
+	 *
+	 * @return self
+	 */
+	public static function fromKey(string $key): self
+	{
+		$iv = openssl_random_pseudo_bytes(self::IV_SIZE);
+		return new static($key, $iv);
+	}
+
+	/**
+	 * {@inheritdoc}
+	 */
+	public function headerParameters(): array
+	{
+		return array_merge(parent::headerParameters(),
+			[AlgorithmParameter::fromAlgorithm($this),
+				InitializationVectorParameter::fromString($this->_iv), ]);
+	}
+
+	/**
+	 * Get GCM Cipher instance.
+	 *
+	 * @return Cipher
+	 */
+	abstract protected function _getGCMCipher(): Cipher;
+
+	/**
+	 * Get the required key size.
+	 *
+	 * @return int
+	 */
+	abstract protected function _keySize(): int;
+
+	/**
+	 * Get GCM instance.
+	 *
+	 * @return GCM
+	 */
+	final protected function _getGCM(): GCM
+	{
+		return new GCM($this->_getGCMCipher(), self::AUTH_TAG_SIZE);
+	}
+
+	/**
+	 * {@inheritdoc}
+	 */
+	protected function _encryptKey(string $key, Header &$header): string
+	{
+		[$ciphertext, $auth_tag] = $this->_getGCM()
+			->encrypt($key, '', $this->_kek, $this->_iv);
+		// insert authentication tag to the header
+		$header = $header->withParameters(
+			AuthenticationTagParameter::fromString($auth_tag));
+		return $ciphertext;
+	}
+
+	/**
+	 * {@inheritdoc}
+	 */
+	protected function _decryptKey(string $ciphertext, Header $header): string
+	{
+		if (!$header->hasAuthenticationTag()) {
+			throw new \RuntimeException(
+				"Header doesn't contain authentication tag.");
+		}
+		$auth_tag = $header->authenticationTag()->authenticationTag();
+		return $this->_getGCM()
+			->decrypt($ciphertext, $auth_tag, '', $this->_kek, $this->_iv);
+	}
 }

Spacing +1 added lines, -1 removed lines

@@ -1,6 +1,6 @@
 <?php
 
-declare(strict_types = 1);
+declare(strict_types=1);
 
 namespace Sop\JWX\JWE\KeyAlgorithm;
 

lib/JWX/JWE/KeyAlgorithm/A128KWAlgorithm.php

Indentation +21 added lines, -21 removed lines

@@ -15,27 +15,27 @@
  */
 class A128KWAlgorithm extends AESKWAlgorithm
 {
-    /**
-     * {@inheritdoc}
-     */
-    public function algorithmParamValue(): string
-    {
-        return JWA::ALGO_A128KW;
-    }
+	/**
+	 * {@inheritdoc}
+	 */
+	public function algorithmParamValue(): string
+	{
+		return JWA::ALGO_A128KW;
+	}
 
-    /**
-     * {@inheritdoc}
-     */
-    protected function _kekSize(): int
-    {
-        return 16;
-    }
+	/**
+	 * {@inheritdoc}
+	 */
+	protected function _kekSize(): int
+	{
+		return 16;
+	}
 
-    /**
-     * {@inheritdoc}
-     */
-    protected function _AESKWAlgo(): AESKeyWrapAlgorithm
-    {
-        return new AESKW128();
-    }
+	/**
+	 * {@inheritdoc}
+	 */
+	protected function _AESKWAlgo(): AESKeyWrapAlgorithm
+	{
+		return new AESKW128();
+	}
 }

Spacing +1 added lines, -1 removed lines

@@ -1,6 +1,6 @@
 <?php
 
-declare(strict_types = 1);
+declare(strict_types=1);
 
 namespace Sop\JWX\JWE\KeyAlgorithm;
 

lib/JWX/JWE/KeyAlgorithm/AESKWAlgorithm.php

Indentation +106 added lines, -106 removed lines

@@ -20,121 +20,121 @@
  */
 abstract class AESKWAlgorithm extends KeyManagementAlgorithm
 {
-    use RandomCEK;
+	use RandomCEK;
 
-    /**
-     * Mapping from algorithm name to class name.
-     *
-     * @internal
-     *
-     * @var array
-     */
-    const MAP_ALGO_TO_CLASS = [
-        JWA::ALGO_A128KW => A128KWAlgorithm::class,
-        JWA::ALGO_A192KW => A192KWAlgorithm::class,
-        JWA::ALGO_A256KW => A256KWAlgorithm::class,
-    ];
+	/**
+	 * Mapping from algorithm name to class name.
+	 *
+	 * @internal
+	 *
+	 * @var array
+	 */
+	const MAP_ALGO_TO_CLASS = [
+		JWA::ALGO_A128KW => A128KWAlgorithm::class,
+		JWA::ALGO_A192KW => A192KWAlgorithm::class,
+		JWA::ALGO_A256KW => A256KWAlgorithm::class,
+	];
 
-    /**
-     * Key encryption key.
-     *
-     * @var string
-     */
-    protected $_kek;
+	/**
+	 * Key encryption key.
+	 *
+	 * @var string
+	 */
+	protected $_kek;
 
-    /**
-     * Key wrapping algorithm.
-     *
-     * Lazily initialized.
-     *
-     * @var null|AESKeyWrapAlgorithm
-     */
-    protected $_kw;
+	/**
+	 * Key wrapping algorithm.
+	 *
+	 * Lazily initialized.
+	 *
+	 * @var null|AESKeyWrapAlgorithm
+	 */
+	protected $_kw;
 
-    /**
-     * Constructor.
-     *
-     * @param string $kek Key encryption key
-     */
-    public function __construct(string $kek)
-    {
-        if (strlen($kek) !== $this->_kekSize()) {
-            throw new \LengthException(
-                'Key encryption key must be ' . $this->_kekSize() . ' bytes.');
-        }
-        $this->_kek = $kek;
-    }
+	/**
+	 * Constructor.
+	 *
+	 * @param string $kek Key encryption key
+	 */
+	public function __construct(string $kek)
+	{
+		if (strlen($kek) !== $this->_kekSize()) {
+			throw new \LengthException(
+				'Key encryption key must be ' . $this->_kekSize() . ' bytes.');
+		}
+		$this->_kek = $kek;
+	}
 
-    /**
-     * Initialize from JWK.
-     *
-     * @param JWK    $jwk
-     * @param Header $header
-     *
-     * @throws \UnexpectedValueException
-     *
-     * @return self
-     */
-    public static function fromJWK(JWK $jwk, Header $header): KeyManagementAlgorithm
-    {
-        $jwk = SymmetricKeyJWK::fromJWK($jwk);
-        $alg = JWA::deriveAlgorithmName($header, $jwk);
-        if (!array_key_exists($alg, self::MAP_ALGO_TO_CLASS)) {
-            throw new \UnexpectedValueException("Unsupported algorithm '{$alg}'.");
-        }
-        $cls = self::MAP_ALGO_TO_CLASS[$alg];
-        return new $cls($jwk->key());
-    }
+	/**
+	 * Initialize from JWK.
+	 *
+	 * @param JWK    $jwk
+	 * @param Header $header
+	 *
+	 * @throws \UnexpectedValueException
+	 *
+	 * @return self
+	 */
+	public static function fromJWK(JWK $jwk, Header $header): KeyManagementAlgorithm
+	{
+		$jwk = SymmetricKeyJWK::fromJWK($jwk);
+		$alg = JWA::deriveAlgorithmName($header, $jwk);
+		if (!array_key_exists($alg, self::MAP_ALGO_TO_CLASS)) {
+			throw new \UnexpectedValueException("Unsupported algorithm '{$alg}'.");
+		}
+		$cls = self::MAP_ALGO_TO_CLASS[$alg];
+		return new $cls($jwk->key());
+	}
 
-    /**
-     * {@inheritdoc}
-     */
-    public function headerParameters(): array
-    {
-        return array_merge(parent::headerParameters(),
-            [AlgorithmParameter::fromAlgorithm($this)]);
-    }
+	/**
+	 * {@inheritdoc}
+	 */
+	public function headerParameters(): array
+	{
+		return array_merge(parent::headerParameters(),
+			[AlgorithmParameter::fromAlgorithm($this)]);
+	}
 
-    /**
-     * Get the size of the key encryption key in bytes.
-     *
-     * @return int
-     */
-    abstract protected function _kekSize(): int;
+	/**
+	 * Get the size of the key encryption key in bytes.
+	 *
+	 * @return int
+	 */
+	abstract protected function _kekSize(): int;
 
-    /**
-     * Get key wrapping algorithm instance.
-     *
-     * @return AESKeyWrapAlgorithm
-     */
-    abstract protected function _AESKWAlgo(): AESKeyWrapAlgorithm;
+	/**
+	 * Get key wrapping algorithm instance.
+	 *
+	 * @return AESKeyWrapAlgorithm
+	 */
+	abstract protected function _AESKWAlgo(): AESKeyWrapAlgorithm;
 
-    /**
-     * Get key wrapping algorithm.
-     *
-     * @return AESKeyWrapAlgorithm
-     */
-    protected function _kw(): AESKeyWrapAlgorithm
-    {
-        if (!isset($this->_kw)) {
-            $this->_kw = $this->_AESKWAlgo();
-        }
-        return $this->_kw;
-    }
+	/**
+	 * Get key wrapping algorithm.
+	 *
+	 * @return AESKeyWrapAlgorithm
+	 */
+	protected function _kw(): AESKeyWrapAlgorithm
+	{
+		if (!isset($this->_kw)) {
+			$this->_kw = $this->_AESKWAlgo();
+		}
+		return $this->_kw;
+	}
 
-    /**
-     * {@inheritdoc}
-     */
-    protected function _encryptKey(string $key, Header &$header): string
-    {
-        return $this->_kw()->wrap($key, $this->_kek);
-    }
+	/**
+	 * {@inheritdoc}
+	 */
+	protected function _encryptKey(string $key, Header &$header): string
+	{
+		return $this->_kw()->wrap($key, $this->_kek);
+	}
 
-    /**
-     * {@inheritdoc}
-     */
-    protected function _decryptKey(string $ciphertext, Header $header): string
-    {
-        return $this->_kw()->unwrap($ciphertext, $this->_kek);
-    }
+	/**
+	 * {@inheritdoc}
+	 */
+	protected function _decryptKey(string $ciphertext, Header $header): string
+	{
+		return $this->_kw()->unwrap($ciphertext, $this->_kek);
+	}
 }

Spacing +1 added lines, -1 removed lines

@@ -1,6 +1,6 @@
 <?php
 
-declare(strict_types = 1);
+declare(strict_types=1);
 
 namespace Sop\JWX\JWE\KeyAlgorithm;