@@ -13,59 +13,59 @@ |
||
13 | 13 | */ |
14 | 14 | class A256CBCHS512Algorithm extends AESCBCAlgorithm |
15 | 15 | { |
16 | - /** |
|
17 | - * {@inheritdoc} |
|
18 | - */ |
|
19 | - public function keySize(): int |
|
20 | - { |
|
21 | - return 64; |
|
22 | - } |
|
16 | + /** |
|
17 | + * {@inheritdoc} |
|
18 | + */ |
|
19 | + public function keySize(): int |
|
20 | + { |
|
21 | + return 64; |
|
22 | + } |
|
23 | 23 | |
24 | - /** |
|
25 | - * {@inheritdoc} |
|
26 | - */ |
|
27 | - public function encryptionAlgorithmParamValue(): string |
|
28 | - { |
|
29 | - return JWA::ALGO_A256CBC_HS512; |
|
30 | - } |
|
24 | + /** |
|
25 | + * {@inheritdoc} |
|
26 | + */ |
|
27 | + public function encryptionAlgorithmParamValue(): string |
|
28 | + { |
|
29 | + return JWA::ALGO_A256CBC_HS512; |
|
30 | + } |
|
31 | 31 | |
32 | - /** |
|
33 | - * {@inheritdoc} |
|
34 | - */ |
|
35 | - protected function _cipherMethod(): string |
|
36 | - { |
|
37 | - return 'aes-256-cbc'; |
|
38 | - } |
|
32 | + /** |
|
33 | + * {@inheritdoc} |
|
34 | + */ |
|
35 | + protected function _cipherMethod(): string |
|
36 | + { |
|
37 | + return 'aes-256-cbc'; |
|
38 | + } |
|
39 | 39 | |
40 | - /** |
|
41 | - * {@inheritdoc} |
|
42 | - */ |
|
43 | - protected function _hashAlgo(): string |
|
44 | - { |
|
45 | - return 'sha512'; |
|
46 | - } |
|
40 | + /** |
|
41 | + * {@inheritdoc} |
|
42 | + */ |
|
43 | + protected function _hashAlgo(): string |
|
44 | + { |
|
45 | + return 'sha512'; |
|
46 | + } |
|
47 | 47 | |
48 | - /** |
|
49 | - * {@inheritdoc} |
|
50 | - */ |
|
51 | - protected function _encKeyLen(): int |
|
52 | - { |
|
53 | - return 32; |
|
54 | - } |
|
48 | + /** |
|
49 | + * {@inheritdoc} |
|
50 | + */ |
|
51 | + protected function _encKeyLen(): int |
|
52 | + { |
|
53 | + return 32; |
|
54 | + } |
|
55 | 55 | |
56 | - /** |
|
57 | - * {@inheritdoc} |
|
58 | - */ |
|
59 | - protected function _macKeyLen(): int |
|
60 | - { |
|
61 | - return 32; |
|
62 | - } |
|
56 | + /** |
|
57 | + * {@inheritdoc} |
|
58 | + */ |
|
59 | + protected function _macKeyLen(): int |
|
60 | + { |
|
61 | + return 32; |
|
62 | + } |
|
63 | 63 | |
64 | - /** |
|
65 | - * {@inheritdoc} |
|
66 | - */ |
|
67 | - protected function _tagLen(): int |
|
68 | - { |
|
69 | - return 32; |
|
70 | - } |
|
64 | + /** |
|
65 | + * {@inheritdoc} |
|
66 | + */ |
|
67 | + protected function _tagLen(): int |
|
68 | + { |
|
69 | + return 32; |
|
70 | + } |
|
71 | 71 | } |
@@ -1,6 +1,6 @@ |
||
1 | 1 | <?php |
2 | 2 | |
3 | -declare(strict_types = 1); |
|
3 | +declare(strict_types=1); |
|
4 | 4 | |
5 | 5 | namespace Sop\JWX\JWE\EncryptionAlgorithm; |
6 | 6 |
@@ -13,59 +13,59 @@ |
||
13 | 13 | */ |
14 | 14 | class A192CBCHS384Algorithm extends AESCBCAlgorithm |
15 | 15 | { |
16 | - /** |
|
17 | - * {@inheritdoc} |
|
18 | - */ |
|
19 | - public function keySize(): int |
|
20 | - { |
|
21 | - return 48; |
|
22 | - } |
|
16 | + /** |
|
17 | + * {@inheritdoc} |
|
18 | + */ |
|
19 | + public function keySize(): int |
|
20 | + { |
|
21 | + return 48; |
|
22 | + } |
|
23 | 23 | |
24 | - /** |
|
25 | - * {@inheritdoc} |
|
26 | - */ |
|
27 | - public function encryptionAlgorithmParamValue(): string |
|
28 | - { |
|
29 | - return JWA::ALGO_A192CBC_HS384; |
|
30 | - } |
|
24 | + /** |
|
25 | + * {@inheritdoc} |
|
26 | + */ |
|
27 | + public function encryptionAlgorithmParamValue(): string |
|
28 | + { |
|
29 | + return JWA::ALGO_A192CBC_HS384; |
|
30 | + } |
|
31 | 31 | |
32 | - /** |
|
33 | - * {@inheritdoc} |
|
34 | - */ |
|
35 | - protected function _cipherMethod(): string |
|
36 | - { |
|
37 | - return 'aes-192-cbc'; |
|
38 | - } |
|
32 | + /** |
|
33 | + * {@inheritdoc} |
|
34 | + */ |
|
35 | + protected function _cipherMethod(): string |
|
36 | + { |
|
37 | + return 'aes-192-cbc'; |
|
38 | + } |
|
39 | 39 | |
40 | - /** |
|
41 | - * {@inheritdoc} |
|
42 | - */ |
|
43 | - protected function _hashAlgo(): string |
|
44 | - { |
|
45 | - return 'sha384'; |
|
46 | - } |
|
40 | + /** |
|
41 | + * {@inheritdoc} |
|
42 | + */ |
|
43 | + protected function _hashAlgo(): string |
|
44 | + { |
|
45 | + return 'sha384'; |
|
46 | + } |
|
47 | 47 | |
48 | - /** |
|
49 | - * {@inheritdoc} |
|
50 | - */ |
|
51 | - protected function _encKeyLen(): int |
|
52 | - { |
|
53 | - return 24; |
|
54 | - } |
|
48 | + /** |
|
49 | + * {@inheritdoc} |
|
50 | + */ |
|
51 | + protected function _encKeyLen(): int |
|
52 | + { |
|
53 | + return 24; |
|
54 | + } |
|
55 | 55 | |
56 | - /** |
|
57 | - * {@inheritdoc} |
|
58 | - */ |
|
59 | - protected function _macKeyLen(): int |
|
60 | - { |
|
61 | - return 24; |
|
62 | - } |
|
56 | + /** |
|
57 | + * {@inheritdoc} |
|
58 | + */ |
|
59 | + protected function _macKeyLen(): int |
|
60 | + { |
|
61 | + return 24; |
|
62 | + } |
|
63 | 63 | |
64 | - /** |
|
65 | - * {@inheritdoc} |
|
66 | - */ |
|
67 | - protected function _tagLen(): int |
|
68 | - { |
|
69 | - return 24; |
|
70 | - } |
|
64 | + /** |
|
65 | + * {@inheritdoc} |
|
66 | + */ |
|
67 | + protected function _tagLen(): int |
|
68 | + { |
|
69 | + return 24; |
|
70 | + } |
|
71 | 71 | } |
@@ -1,6 +1,6 @@ |
||
1 | 1 | <?php |
2 | 2 | |
3 | -declare(strict_types = 1); |
|
3 | +declare(strict_types=1); |
|
4 | 4 | |
5 | 5 | namespace Sop\JWX\JWE\EncryptionAlgorithm; |
6 | 6 |
@@ -13,58 +13,58 @@ |
||
13 | 13 | */ |
14 | 14 | abstract class EncryptionAlgorithmFactory |
15 | 15 | { |
16 | - /** |
|
17 | - * Mapping from algorithm name to class name. |
|
18 | - * |
|
19 | - * @internal |
|
20 | - * |
|
21 | - * @var array |
|
22 | - */ |
|
23 | - const MAP_ALGO_TO_CLASS = [ |
|
24 | - JWA::ALGO_A128CBC_HS256 => A128CBCHS256Algorithm::class, |
|
25 | - JWA::ALGO_A192CBC_HS384 => A192CBCHS384Algorithm::class, |
|
26 | - JWA::ALGO_A256CBC_HS512 => A256CBCHS512Algorithm::class, |
|
27 | - JWA::ALGO_A128GCM => A128GCMAlgorithm::class, |
|
28 | - JWA::ALGO_A192GCM => A192GCMAlgorithm::class, |
|
29 | - JWA::ALGO_A256GCM => A256GCMAlgorithm::class, |
|
30 | - ]; |
|
16 | + /** |
|
17 | + * Mapping from algorithm name to class name. |
|
18 | + * |
|
19 | + * @internal |
|
20 | + * |
|
21 | + * @var array |
|
22 | + */ |
|
23 | + const MAP_ALGO_TO_CLASS = [ |
|
24 | + JWA::ALGO_A128CBC_HS256 => A128CBCHS256Algorithm::class, |
|
25 | + JWA::ALGO_A192CBC_HS384 => A192CBCHS384Algorithm::class, |
|
26 | + JWA::ALGO_A256CBC_HS512 => A256CBCHS512Algorithm::class, |
|
27 | + JWA::ALGO_A128GCM => A128GCMAlgorithm::class, |
|
28 | + JWA::ALGO_A192GCM => A192GCMAlgorithm::class, |
|
29 | + JWA::ALGO_A256GCM => A256GCMAlgorithm::class, |
|
30 | + ]; |
|
31 | 31 | |
32 | - /** |
|
33 | - * Get the content encryption algorithm by algorithm name. |
|
34 | - * |
|
35 | - * @param string $name Algorithm name |
|
36 | - * |
|
37 | - * @throws \UnexpectedValueException if algorithm is not supported |
|
38 | - * |
|
39 | - * @return ContentEncryptionAlgorithm |
|
40 | - */ |
|
41 | - public static function algoByName(string $name): ContentEncryptionAlgorithm |
|
42 | - { |
|
43 | - if (!array_key_exists($name, self::MAP_ALGO_TO_CLASS)) { |
|
44 | - throw new \UnexpectedValueException( |
|
45 | - "No content encryption algorithm '{$name}'."); |
|
46 | - } |
|
47 | - $cls = self::MAP_ALGO_TO_CLASS[$name]; |
|
48 | - return new $cls(); |
|
49 | - } |
|
32 | + /** |
|
33 | + * Get the content encryption algorithm by algorithm name. |
|
34 | + * |
|
35 | + * @param string $name Algorithm name |
|
36 | + * |
|
37 | + * @throws \UnexpectedValueException if algorithm is not supported |
|
38 | + * |
|
39 | + * @return ContentEncryptionAlgorithm |
|
40 | + */ |
|
41 | + public static function algoByName(string $name): ContentEncryptionAlgorithm |
|
42 | + { |
|
43 | + if (!array_key_exists($name, self::MAP_ALGO_TO_CLASS)) { |
|
44 | + throw new \UnexpectedValueException( |
|
45 | + "No content encryption algorithm '{$name}'."); |
|
46 | + } |
|
47 | + $cls = self::MAP_ALGO_TO_CLASS[$name]; |
|
48 | + return new $cls(); |
|
49 | + } |
|
50 | 50 | |
51 | - /** |
|
52 | - * Get the content encryption algorithm as specified in the given header. |
|
53 | - * |
|
54 | - * @param Header $header Header |
|
55 | - * |
|
56 | - * @throws \UnexpectedValueException If content encryption algorithm |
|
57 | - * parameter is not present or algorithm |
|
58 | - * is not supported |
|
59 | - * |
|
60 | - * @return ContentEncryptionAlgorithm |
|
61 | - */ |
|
62 | - public static function algoByHeader(Header $header): ContentEncryptionAlgorithm |
|
63 | - { |
|
64 | - if (!$header->hasEncryptionAlgorithm()) { |
|
65 | - throw new \UnexpectedValueException( |
|
66 | - 'No encryption algorithm parameter.'); |
|
67 | - } |
|
68 | - return self::algoByName($header->encryptionAlgorithm()->value()); |
|
69 | - } |
|
51 | + /** |
|
52 | + * Get the content encryption algorithm as specified in the given header. |
|
53 | + * |
|
54 | + * @param Header $header Header |
|
55 | + * |
|
56 | + * @throws \UnexpectedValueException If content encryption algorithm |
|
57 | + * parameter is not present or algorithm |
|
58 | + * is not supported |
|
59 | + * |
|
60 | + * @return ContentEncryptionAlgorithm |
|
61 | + */ |
|
62 | + public static function algoByHeader(Header $header): ContentEncryptionAlgorithm |
|
63 | + { |
|
64 | + if (!$header->hasEncryptionAlgorithm()) { |
|
65 | + throw new \UnexpectedValueException( |
|
66 | + 'No encryption algorithm parameter.'); |
|
67 | + } |
|
68 | + return self::algoByName($header->encryptionAlgorithm()->value()); |
|
69 | + } |
|
70 | 70 | } |
@@ -1,6 +1,6 @@ |
||
1 | 1 | <?php |
2 | 2 | |
3 | -declare(strict_types = 1); |
|
3 | +declare(strict_types=1); |
|
4 | 4 | |
5 | 5 | namespace Sop\JWX\JWE\EncryptionAlgorithm; |
6 | 6 |
@@ -15,214 +15,214 @@ |
||
15 | 15 | */ |
16 | 16 | abstract class AESCBCAlgorithm implements ContentEncryptionAlgorithm |
17 | 17 | { |
18 | - /** |
|
19 | - * {@inheritdoc} |
|
20 | - */ |
|
21 | - public function encrypt(string $plaintext, string $key, string $iv, |
|
22 | - string $aad): array |
|
23 | - { |
|
24 | - $this->_validateKey($key); |
|
25 | - $this->_validateIV($iv); |
|
26 | - $ciphertext = openssl_encrypt($plaintext, $this->_getCipherMethod(), |
|
27 | - $this->_encKey($key), OPENSSL_RAW_DATA, $iv); |
|
28 | - if (false === $ciphertext) { |
|
29 | - throw new \RuntimeException( |
|
30 | - 'openssl_encrypt() failed: ' . $this->_getLastOpenSSLError()); |
|
31 | - } |
|
32 | - $auth_data = $aad . $iv . $ciphertext . $this->_aadLen($aad); |
|
33 | - $auth_tag = $this->_computeAuthTag($auth_data, $key); |
|
34 | - return [$ciphertext, $auth_tag]; |
|
35 | - } |
|
36 | - |
|
37 | - /** |
|
38 | - * {@inheritdoc} |
|
39 | - */ |
|
40 | - public function decrypt(string $ciphertext, string $key, string $iv, |
|
41 | - string $aad, string $auth_tag): string |
|
42 | - { |
|
43 | - $this->_validateKey($key); |
|
44 | - $this->_validateIV($iv); |
|
45 | - $auth_data = $aad . $iv . $ciphertext . $this->_aadLen($aad); |
|
46 | - if ($this->_computeAuthTag($auth_data, $key) !== $auth_tag) { |
|
47 | - throw new AuthenticationException('Message authentication failed.'); |
|
48 | - } |
|
49 | - $plaintext = openssl_decrypt($ciphertext, $this->_getCipherMethod(), |
|
50 | - $this->_encKey($key), OPENSSL_RAW_DATA, $iv); |
|
51 | - if (false === $plaintext) { |
|
52 | - throw new \RuntimeException( |
|
53 | - 'openssl_decrypt() failed: ' . $this->_getLastOpenSSLError()); |
|
54 | - } |
|
55 | - return $plaintext; |
|
56 | - } |
|
57 | - |
|
58 | - /** |
|
59 | - * {@inheritdoc} |
|
60 | - */ |
|
61 | - public function ivSize(): int |
|
62 | - { |
|
63 | - return 16; |
|
64 | - } |
|
65 | - |
|
66 | - /** |
|
67 | - * {@inheritdoc} |
|
68 | - */ |
|
69 | - public function headerParameters(): array |
|
70 | - { |
|
71 | - return [EncryptionAlgorithmParameter::fromAlgorithm($this)]; |
|
72 | - } |
|
73 | - |
|
74 | - /** |
|
75 | - * Get cipher method name that is recognized by OpenSSL. |
|
76 | - * |
|
77 | - * @return string |
|
78 | - */ |
|
79 | - abstract protected function _cipherMethod(): string; |
|
80 | - |
|
81 | - /** |
|
82 | - * Get algorithm name that is recognized by the Hash extension. |
|
83 | - * |
|
84 | - * @return string |
|
85 | - */ |
|
86 | - abstract protected function _hashAlgo(): string; |
|
87 | - |
|
88 | - /** |
|
89 | - * Get length of the encryption key. |
|
90 | - * |
|
91 | - * @return int |
|
92 | - */ |
|
93 | - abstract protected function _encKeyLen(): int; |
|
94 | - |
|
95 | - /** |
|
96 | - * Get length of the MAC key. |
|
97 | - * |
|
98 | - * @return int |
|
99 | - */ |
|
100 | - abstract protected function _macKeyLen(): int; |
|
101 | - |
|
102 | - /** |
|
103 | - * Get length of the authentication tag. |
|
104 | - * |
|
105 | - * @return int |
|
106 | - */ |
|
107 | - abstract protected function _tagLen(): int; |
|
108 | - |
|
109 | - /** |
|
110 | - * Get cipher method and verify that it's supported. |
|
111 | - * |
|
112 | - * @throws \RuntimeException |
|
113 | - * |
|
114 | - * @return string |
|
115 | - */ |
|
116 | - final protected function _getCipherMethod(): string |
|
117 | - { |
|
118 | - static $supported_ciphers; |
|
119 | - if (!isset($supported_ciphers)) { |
|
120 | - $supported_ciphers = array_flip( |
|
121 | - array_map('strtolower', openssl_get_cipher_methods(false))); |
|
122 | - } |
|
123 | - $method = $this->_cipherMethod(); |
|
124 | - if (!isset($supported_ciphers[$method])) { |
|
125 | - throw new \RuntimeException( |
|
126 | - "Cipher method {$method} is not" . |
|
127 | - ' supported by this version of OpenSSL.'); |
|
128 | - } |
|
129 | - return $method; |
|
130 | - } |
|
131 | - |
|
132 | - /** |
|
133 | - * Check that key is valid. |
|
134 | - * |
|
135 | - * @param string $key |
|
136 | - * |
|
137 | - * @throws \RuntimeException |
|
138 | - */ |
|
139 | - final protected function _validateKey(string $key): void |
|
140 | - { |
|
141 | - if (strlen($key) !== $this->keySize()) { |
|
142 | - throw new \RuntimeException('Invalid key size.'); |
|
143 | - } |
|
144 | - } |
|
145 | - |
|
146 | - /** |
|
147 | - * Check that IV is valid. |
|
148 | - * |
|
149 | - * @param string $iv |
|
150 | - * |
|
151 | - * @throws \RuntimeException |
|
152 | - */ |
|
153 | - final protected function _validateIV(string $iv): void |
|
154 | - { |
|
155 | - $len = openssl_cipher_iv_length($this->_getCipherMethod()); |
|
156 | - if ($len !== strlen($iv)) { |
|
157 | - throw new \RuntimeException('Invalid IV length.'); |
|
158 | - } |
|
159 | - } |
|
160 | - |
|
161 | - /** |
|
162 | - * Get MAC key from CEK. |
|
163 | - * |
|
164 | - * @param string $key |
|
165 | - * |
|
166 | - * @return string |
|
167 | - */ |
|
168 | - final protected function _macKey(string $key): string |
|
169 | - { |
|
170 | - return substr($key, 0, $this->_macKeyLen()); |
|
171 | - } |
|
172 | - |
|
173 | - /** |
|
174 | - * Get encryption key from CEK. |
|
175 | - * |
|
176 | - * @param string $key |
|
177 | - * |
|
178 | - * @return string |
|
179 | - */ |
|
180 | - final protected function _encKey(string $key): string |
|
181 | - { |
|
182 | - return substr($key, -$this->_encKeyLen()); |
|
183 | - } |
|
184 | - |
|
185 | - /** |
|
186 | - * Compute AL value. |
|
187 | - * |
|
188 | - * @param string $aad |
|
189 | - * |
|
190 | - * @return string 64 bits |
|
191 | - */ |
|
192 | - final protected function _aadLen(string $aad): string |
|
193 | - { |
|
194 | - // truncate on 32 bit hosts |
|
195 | - if (PHP_INT_SIZE < 8) { |
|
196 | - return "\0\0\0\0" . pack('N', strlen($aad) * 8); |
|
197 | - } |
|
198 | - return pack('J', strlen($aad) * 8); |
|
199 | - } |
|
200 | - |
|
201 | - /** |
|
202 | - * Compute authentication tag. |
|
203 | - * |
|
204 | - * @param string $data |
|
205 | - * @param string $key CEK |
|
206 | - * |
|
207 | - * @return string |
|
208 | - */ |
|
209 | - final protected function _computeAuthTag(string $data, string $key): string |
|
210 | - { |
|
211 | - $tag = hash_hmac($this->_hashAlgo(), $data, $this->_macKey($key), true); |
|
212 | - return substr($tag, 0, $this->_tagLen()); |
|
213 | - } |
|
214 | - |
|
215 | - /** |
|
216 | - * Get last OpenSSL error message. |
|
217 | - * |
|
218 | - * @return null|string |
|
219 | - */ |
|
220 | - protected function _getLastOpenSSLError(): ?string |
|
221 | - { |
|
222 | - $msg = null; |
|
223 | - while (false !== ($err = openssl_error_string())) { |
|
224 | - $msg = $err; |
|
225 | - } |
|
226 | - return $msg; |
|
227 | - } |
|
18 | + /** |
|
19 | + * {@inheritdoc} |
|
20 | + */ |
|
21 | + public function encrypt(string $plaintext, string $key, string $iv, |
|
22 | + string $aad): array |
|
23 | + { |
|
24 | + $this->_validateKey($key); |
|
25 | + $this->_validateIV($iv); |
|
26 | + $ciphertext = openssl_encrypt($plaintext, $this->_getCipherMethod(), |
|
27 | + $this->_encKey($key), OPENSSL_RAW_DATA, $iv); |
|
28 | + if (false === $ciphertext) { |
|
29 | + throw new \RuntimeException( |
|
30 | + 'openssl_encrypt() failed: ' . $this->_getLastOpenSSLError()); |
|
31 | + } |
|
32 | + $auth_data = $aad . $iv . $ciphertext . $this->_aadLen($aad); |
|
33 | + $auth_tag = $this->_computeAuthTag($auth_data, $key); |
|
34 | + return [$ciphertext, $auth_tag]; |
|
35 | + } |
|
36 | + |
|
37 | + /** |
|
38 | + * {@inheritdoc} |
|
39 | + */ |
|
40 | + public function decrypt(string $ciphertext, string $key, string $iv, |
|
41 | + string $aad, string $auth_tag): string |
|
42 | + { |
|
43 | + $this->_validateKey($key); |
|
44 | + $this->_validateIV($iv); |
|
45 | + $auth_data = $aad . $iv . $ciphertext . $this->_aadLen($aad); |
|
46 | + if ($this->_computeAuthTag($auth_data, $key) !== $auth_tag) { |
|
47 | + throw new AuthenticationException('Message authentication failed.'); |
|
48 | + } |
|
49 | + $plaintext = openssl_decrypt($ciphertext, $this->_getCipherMethod(), |
|
50 | + $this->_encKey($key), OPENSSL_RAW_DATA, $iv); |
|
51 | + if (false === $plaintext) { |
|
52 | + throw new \RuntimeException( |
|
53 | + 'openssl_decrypt() failed: ' . $this->_getLastOpenSSLError()); |
|
54 | + } |
|
55 | + return $plaintext; |
|
56 | + } |
|
57 | + |
|
58 | + /** |
|
59 | + * {@inheritdoc} |
|
60 | + */ |
|
61 | + public function ivSize(): int |
|
62 | + { |
|
63 | + return 16; |
|
64 | + } |
|
65 | + |
|
66 | + /** |
|
67 | + * {@inheritdoc} |
|
68 | + */ |
|
69 | + public function headerParameters(): array |
|
70 | + { |
|
71 | + return [EncryptionAlgorithmParameter::fromAlgorithm($this)]; |
|
72 | + } |
|
73 | + |
|
74 | + /** |
|
75 | + * Get cipher method name that is recognized by OpenSSL. |
|
76 | + * |
|
77 | + * @return string |
|
78 | + */ |
|
79 | + abstract protected function _cipherMethod(): string; |
|
80 | + |
|
81 | + /** |
|
82 | + * Get algorithm name that is recognized by the Hash extension. |
|
83 | + * |
|
84 | + * @return string |
|
85 | + */ |
|
86 | + abstract protected function _hashAlgo(): string; |
|
87 | + |
|
88 | + /** |
|
89 | + * Get length of the encryption key. |
|
90 | + * |
|
91 | + * @return int |
|
92 | + */ |
|
93 | + abstract protected function _encKeyLen(): int; |
|
94 | + |
|
95 | + /** |
|
96 | + * Get length of the MAC key. |
|
97 | + * |
|
98 | + * @return int |
|
99 | + */ |
|
100 | + abstract protected function _macKeyLen(): int; |
|
101 | + |
|
102 | + /** |
|
103 | + * Get length of the authentication tag. |
|
104 | + * |
|
105 | + * @return int |
|
106 | + */ |
|
107 | + abstract protected function _tagLen(): int; |
|
108 | + |
|
109 | + /** |
|
110 | + * Get cipher method and verify that it's supported. |
|
111 | + * |
|
112 | + * @throws \RuntimeException |
|
113 | + * |
|
114 | + * @return string |
|
115 | + */ |
|
116 | + final protected function _getCipherMethod(): string |
|
117 | + { |
|
118 | + static $supported_ciphers; |
|
119 | + if (!isset($supported_ciphers)) { |
|
120 | + $supported_ciphers = array_flip( |
|
121 | + array_map('strtolower', openssl_get_cipher_methods(false))); |
|
122 | + } |
|
123 | + $method = $this->_cipherMethod(); |
|
124 | + if (!isset($supported_ciphers[$method])) { |
|
125 | + throw new \RuntimeException( |
|
126 | + "Cipher method {$method} is not" . |
|
127 | + ' supported by this version of OpenSSL.'); |
|
128 | + } |
|
129 | + return $method; |
|
130 | + } |
|
131 | + |
|
132 | + /** |
|
133 | + * Check that key is valid. |
|
134 | + * |
|
135 | + * @param string $key |
|
136 | + * |
|
137 | + * @throws \RuntimeException |
|
138 | + */ |
|
139 | + final protected function _validateKey(string $key): void |
|
140 | + { |
|
141 | + if (strlen($key) !== $this->keySize()) { |
|
142 | + throw new \RuntimeException('Invalid key size.'); |
|
143 | + } |
|
144 | + } |
|
145 | + |
|
146 | + /** |
|
147 | + * Check that IV is valid. |
|
148 | + * |
|
149 | + * @param string $iv |
|
150 | + * |
|
151 | + * @throws \RuntimeException |
|
152 | + */ |
|
153 | + final protected function _validateIV(string $iv): void |
|
154 | + { |
|
155 | + $len = openssl_cipher_iv_length($this->_getCipherMethod()); |
|
156 | + if ($len !== strlen($iv)) { |
|
157 | + throw new \RuntimeException('Invalid IV length.'); |
|
158 | + } |
|
159 | + } |
|
160 | + |
|
161 | + /** |
|
162 | + * Get MAC key from CEK. |
|
163 | + * |
|
164 | + * @param string $key |
|
165 | + * |
|
166 | + * @return string |
|
167 | + */ |
|
168 | + final protected function _macKey(string $key): string |
|
169 | + { |
|
170 | + return substr($key, 0, $this->_macKeyLen()); |
|
171 | + } |
|
172 | + |
|
173 | + /** |
|
174 | + * Get encryption key from CEK. |
|
175 | + * |
|
176 | + * @param string $key |
|
177 | + * |
|
178 | + * @return string |
|
179 | + */ |
|
180 | + final protected function _encKey(string $key): string |
|
181 | + { |
|
182 | + return substr($key, -$this->_encKeyLen()); |
|
183 | + } |
|
184 | + |
|
185 | + /** |
|
186 | + * Compute AL value. |
|
187 | + * |
|
188 | + * @param string $aad |
|
189 | + * |
|
190 | + * @return string 64 bits |
|
191 | + */ |
|
192 | + final protected function _aadLen(string $aad): string |
|
193 | + { |
|
194 | + // truncate on 32 bit hosts |
|
195 | + if (PHP_INT_SIZE < 8) { |
|
196 | + return "\0\0\0\0" . pack('N', strlen($aad) * 8); |
|
197 | + } |
|
198 | + return pack('J', strlen($aad) * 8); |
|
199 | + } |
|
200 | + |
|
201 | + /** |
|
202 | + * Compute authentication tag. |
|
203 | + * |
|
204 | + * @param string $data |
|
205 | + * @param string $key CEK |
|
206 | + * |
|
207 | + * @return string |
|
208 | + */ |
|
209 | + final protected function _computeAuthTag(string $data, string $key): string |
|
210 | + { |
|
211 | + $tag = hash_hmac($this->_hashAlgo(), $data, $this->_macKey($key), true); |
|
212 | + return substr($tag, 0, $this->_tagLen()); |
|
213 | + } |
|
214 | + |
|
215 | + /** |
|
216 | + * Get last OpenSSL error message. |
|
217 | + * |
|
218 | + * @return null|string |
|
219 | + */ |
|
220 | + protected function _getLastOpenSSLError(): ?string |
|
221 | + { |
|
222 | + $msg = null; |
|
223 | + while (false !== ($err = openssl_error_string())) { |
|
224 | + $msg = $err; |
|
225 | + } |
|
226 | + return $msg; |
|
227 | + } |
|
228 | 228 | } |
@@ -1,6 +1,6 @@ |
||
1 | 1 | <?php |
2 | 2 | |
3 | -declare(strict_types = 1); |
|
3 | +declare(strict_types=1); |
|
4 | 4 | |
5 | 5 | namespace Sop\JWX\JWE\EncryptionAlgorithm; |
6 | 6 |
@@ -13,59 +13,59 @@ |
||
13 | 13 | */ |
14 | 14 | class A128CBCHS256Algorithm extends AESCBCAlgorithm |
15 | 15 | { |
16 | - /** |
|
17 | - * {@inheritdoc} |
|
18 | - */ |
|
19 | - public function keySize(): int |
|
20 | - { |
|
21 | - return 32; |
|
22 | - } |
|
16 | + /** |
|
17 | + * {@inheritdoc} |
|
18 | + */ |
|
19 | + public function keySize(): int |
|
20 | + { |
|
21 | + return 32; |
|
22 | + } |
|
23 | 23 | |
24 | - /** |
|
25 | - * {@inheritdoc} |
|
26 | - */ |
|
27 | - public function encryptionAlgorithmParamValue(): string |
|
28 | - { |
|
29 | - return JWA::ALGO_A128CBC_HS256; |
|
30 | - } |
|
24 | + /** |
|
25 | + * {@inheritdoc} |
|
26 | + */ |
|
27 | + public function encryptionAlgorithmParamValue(): string |
|
28 | + { |
|
29 | + return JWA::ALGO_A128CBC_HS256; |
|
30 | + } |
|
31 | 31 | |
32 | - /** |
|
33 | - * {@inheritdoc} |
|
34 | - */ |
|
35 | - protected function _cipherMethod(): string |
|
36 | - { |
|
37 | - return 'aes-128-cbc'; |
|
38 | - } |
|
32 | + /** |
|
33 | + * {@inheritdoc} |
|
34 | + */ |
|
35 | + protected function _cipherMethod(): string |
|
36 | + { |
|
37 | + return 'aes-128-cbc'; |
|
38 | + } |
|
39 | 39 | |
40 | - /** |
|
41 | - * {@inheritdoc} |
|
42 | - */ |
|
43 | - protected function _hashAlgo(): string |
|
44 | - { |
|
45 | - return 'sha256'; |
|
46 | - } |
|
40 | + /** |
|
41 | + * {@inheritdoc} |
|
42 | + */ |
|
43 | + protected function _hashAlgo(): string |
|
44 | + { |
|
45 | + return 'sha256'; |
|
46 | + } |
|
47 | 47 | |
48 | - /** |
|
49 | - * {@inheritdoc} |
|
50 | - */ |
|
51 | - protected function _encKeyLen(): int |
|
52 | - { |
|
53 | - return 16; |
|
54 | - } |
|
48 | + /** |
|
49 | + * {@inheritdoc} |
|
50 | + */ |
|
51 | + protected function _encKeyLen(): int |
|
52 | + { |
|
53 | + return 16; |
|
54 | + } |
|
55 | 55 | |
56 | - /** |
|
57 | - * {@inheritdoc} |
|
58 | - */ |
|
59 | - protected function _macKeyLen(): int |
|
60 | - { |
|
61 | - return 16; |
|
62 | - } |
|
56 | + /** |
|
57 | + * {@inheritdoc} |
|
58 | + */ |
|
59 | + protected function _macKeyLen(): int |
|
60 | + { |
|
61 | + return 16; |
|
62 | + } |
|
63 | 63 | |
64 | - /** |
|
65 | - * {@inheritdoc} |
|
66 | - */ |
|
67 | - protected function _tagLen(): int |
|
68 | - { |
|
69 | - return 16; |
|
70 | - } |
|
64 | + /** |
|
65 | + * {@inheritdoc} |
|
66 | + */ |
|
67 | + protected function _tagLen(): int |
|
68 | + { |
|
69 | + return 16; |
|
70 | + } |
|
71 | 71 | } |
@@ -1,6 +1,6 @@ |
||
1 | 1 | <?php |
2 | 2 | |
3 | -declare(strict_types = 1); |
|
3 | +declare(strict_types=1); |
|
4 | 4 | |
5 | 5 | namespace Sop\JWX\JWE\EncryptionAlgorithm; |
6 | 6 |
@@ -16,71 +16,71 @@ |
||
16 | 16 | */ |
17 | 17 | class DeflateAlgorithm implements CompressionAlgorithm |
18 | 18 | { |
19 | - /** |
|
20 | - * Compression level. |
|
21 | - * |
|
22 | - * @var int |
|
23 | - */ |
|
24 | - protected $_compressionLevel; |
|
19 | + /** |
|
20 | + * Compression level. |
|
21 | + * |
|
22 | + * @var int |
|
23 | + */ |
|
24 | + protected $_compressionLevel; |
|
25 | 25 | |
26 | - /** |
|
27 | - * Constructor. |
|
28 | - * |
|
29 | - * @param int $level Compression level 0..9 |
|
30 | - */ |
|
31 | - public function __construct(int $level = -1) |
|
32 | - { |
|
33 | - if ($level < -1 || $level > 9) { |
|
34 | - throw new \DomainException('Compression level must be -1..9.'); |
|
35 | - } |
|
36 | - $this->_compressionLevel = $level; |
|
37 | - } |
|
26 | + /** |
|
27 | + * Constructor. |
|
28 | + * |
|
29 | + * @param int $level Compression level 0..9 |
|
30 | + */ |
|
31 | + public function __construct(int $level = -1) |
|
32 | + { |
|
33 | + if ($level < -1 || $level > 9) { |
|
34 | + throw new \DomainException('Compression level must be -1..9.'); |
|
35 | + } |
|
36 | + $this->_compressionLevel = $level; |
|
37 | + } |
|
38 | 38 | |
39 | - /** |
|
40 | - * {@inheritdoc} |
|
41 | - * |
|
42 | - * @throws \RuntimeException |
|
43 | - */ |
|
44 | - public function compress(string $data): string |
|
45 | - { |
|
46 | - $ret = @gzdeflate($data, $this->_compressionLevel); |
|
47 | - if (false === $ret) { |
|
48 | - $err = error_get_last(); |
|
49 | - $msg = isset($err) && __FILE__ === $err['file'] ? $err['message'] : null; |
|
50 | - throw new \RuntimeException($msg ?? 'gzdeflate() failed.'); |
|
51 | - } |
|
52 | - return $ret; |
|
53 | - } |
|
39 | + /** |
|
40 | + * {@inheritdoc} |
|
41 | + * |
|
42 | + * @throws \RuntimeException |
|
43 | + */ |
|
44 | + public function compress(string $data): string |
|
45 | + { |
|
46 | + $ret = @gzdeflate($data, $this->_compressionLevel); |
|
47 | + if (false === $ret) { |
|
48 | + $err = error_get_last(); |
|
49 | + $msg = isset($err) && __FILE__ === $err['file'] ? $err['message'] : null; |
|
50 | + throw new \RuntimeException($msg ?? 'gzdeflate() failed.'); |
|
51 | + } |
|
52 | + return $ret; |
|
53 | + } |
|
54 | 54 | |
55 | - /** |
|
56 | - * {@inheritdoc} |
|
57 | - * |
|
58 | - * @throws \RuntimeException |
|
59 | - */ |
|
60 | - public function decompress(string $data): string |
|
61 | - { |
|
62 | - $ret = @gzinflate($data); |
|
63 | - if (false === $ret) { |
|
64 | - $err = error_get_last(); |
|
65 | - $msg = isset($err) && __FILE__ === $err['file'] ? $err['message'] : null; |
|
66 | - throw new \RuntimeException($msg ?? 'gzinflate() failed.'); |
|
67 | - } |
|
68 | - return $ret; |
|
69 | - } |
|
55 | + /** |
|
56 | + * {@inheritdoc} |
|
57 | + * |
|
58 | + * @throws \RuntimeException |
|
59 | + */ |
|
60 | + public function decompress(string $data): string |
|
61 | + { |
|
62 | + $ret = @gzinflate($data); |
|
63 | + if (false === $ret) { |
|
64 | + $err = error_get_last(); |
|
65 | + $msg = isset($err) && __FILE__ === $err['file'] ? $err['message'] : null; |
|
66 | + throw new \RuntimeException($msg ?? 'gzinflate() failed.'); |
|
67 | + } |
|
68 | + return $ret; |
|
69 | + } |
|
70 | 70 | |
71 | - /** |
|
72 | - * {@inheritdoc} |
|
73 | - */ |
|
74 | - public function compressionParamValue(): string |
|
75 | - { |
|
76 | - return JWA::ALGO_DEFLATE; |
|
77 | - } |
|
71 | + /** |
|
72 | + * {@inheritdoc} |
|
73 | + */ |
|
74 | + public function compressionParamValue(): string |
|
75 | + { |
|
76 | + return JWA::ALGO_DEFLATE; |
|
77 | + } |
|
78 | 78 | |
79 | - /** |
|
80 | - * {@inheritdoc} |
|
81 | - */ |
|
82 | - public function headerParameters(): array |
|
83 | - { |
|
84 | - return [CompressionAlgorithmParameter::fromAlgorithm($this)]; |
|
85 | - } |
|
79 | + /** |
|
80 | + * {@inheritdoc} |
|
81 | + */ |
|
82 | + public function headerParameters(): array |
|
83 | + { |
|
84 | + return [CompressionAlgorithmParameter::fromAlgorithm($this)]; |
|
85 | + } |
|
86 | 86 | } |
@@ -1,6 +1,6 @@ |
||
1 | 1 | <?php |
2 | 2 | |
3 | -declare(strict_types = 1); |
|
3 | +declare(strict_types=1); |
|
4 | 4 | |
5 | 5 | namespace Sop\JWX\JWE\CompressionAlgorithm; |
6 | 6 |
@@ -13,52 +13,52 @@ |
||
13 | 13 | */ |
14 | 14 | abstract class CompressionFactory |
15 | 15 | { |
16 | - /** |
|
17 | - * Mapping from algorithm name to class name. |
|
18 | - * |
|
19 | - * @internal |
|
20 | - * |
|
21 | - * @var array |
|
22 | - */ |
|
23 | - const MAP_ALGO_TO_CLASS = [ |
|
24 | - JWA::ALGO_DEFLATE => DeflateAlgorithm::class, |
|
25 | - ]; |
|
16 | + /** |
|
17 | + * Mapping from algorithm name to class name. |
|
18 | + * |
|
19 | + * @internal |
|
20 | + * |
|
21 | + * @var array |
|
22 | + */ |
|
23 | + const MAP_ALGO_TO_CLASS = [ |
|
24 | + JWA::ALGO_DEFLATE => DeflateAlgorithm::class, |
|
25 | + ]; |
|
26 | 26 | |
27 | - /** |
|
28 | - * Get the compression algorithm by name. |
|
29 | - * |
|
30 | - * @param string $name |
|
31 | - * |
|
32 | - * @throws \UnexpectedValueException If algorithm is not supported |
|
33 | - * |
|
34 | - * @return CompressionAlgorithm |
|
35 | - */ |
|
36 | - public static function algoByName(string $name): CompressionAlgorithm |
|
37 | - { |
|
38 | - if (!array_key_exists($name, self::MAP_ALGO_TO_CLASS)) { |
|
39 | - throw new \UnexpectedValueException( |
|
40 | - "No compression algorithm '{$name}'."); |
|
41 | - } |
|
42 | - $cls = self::MAP_ALGO_TO_CLASS[$name]; |
|
43 | - return new $cls(); |
|
44 | - } |
|
27 | + /** |
|
28 | + * Get the compression algorithm by name. |
|
29 | + * |
|
30 | + * @param string $name |
|
31 | + * |
|
32 | + * @throws \UnexpectedValueException If algorithm is not supported |
|
33 | + * |
|
34 | + * @return CompressionAlgorithm |
|
35 | + */ |
|
36 | + public static function algoByName(string $name): CompressionAlgorithm |
|
37 | + { |
|
38 | + if (!array_key_exists($name, self::MAP_ALGO_TO_CLASS)) { |
|
39 | + throw new \UnexpectedValueException( |
|
40 | + "No compression algorithm '{$name}'."); |
|
41 | + } |
|
42 | + $cls = self::MAP_ALGO_TO_CLASS[$name]; |
|
43 | + return new $cls(); |
|
44 | + } |
|
45 | 45 | |
46 | - /** |
|
47 | - * Get the compression algorithm as specified in the given header. |
|
48 | - * |
|
49 | - * @param Header $header Header |
|
50 | - * |
|
51 | - * @throws \UnexpectedValueException If compression algorithm parameter is |
|
52 | - * not present or algorithm is not supported |
|
53 | - * |
|
54 | - * @return CompressionAlgorithm |
|
55 | - */ |
|
56 | - public static function algoByHeader(Header $header): CompressionAlgorithm |
|
57 | - { |
|
58 | - if (!$header->hasCompressionAlgorithm()) { |
|
59 | - throw new \UnexpectedValueException( |
|
60 | - 'No compression algorithm parameter.'); |
|
61 | - } |
|
62 | - return self::algoByName($header->compressionAlgorithm()->value()); |
|
63 | - } |
|
46 | + /** |
|
47 | + * Get the compression algorithm as specified in the given header. |
|
48 | + * |
|
49 | + * @param Header $header Header |
|
50 | + * |
|
51 | + * @throws \UnexpectedValueException If compression algorithm parameter is |
|
52 | + * not present or algorithm is not supported |
|
53 | + * |
|
54 | + * @return CompressionAlgorithm |
|
55 | + */ |
|
56 | + public static function algoByHeader(Header $header): CompressionAlgorithm |
|
57 | + { |
|
58 | + if (!$header->hasCompressionAlgorithm()) { |
|
59 | + throw new \UnexpectedValueException( |
|
60 | + 'No compression algorithm parameter.'); |
|
61 | + } |
|
62 | + return self::algoByName($header->compressionAlgorithm()->value()); |
|
63 | + } |
|
64 | 64 | } |
@@ -1,6 +1,6 @@ |
||
1 | 1 | <?php |
2 | 2 | |
3 | -declare(strict_types = 1); |
|
3 | +declare(strict_types=1); |
|
4 | 4 | |
5 | 5 | namespace Sop\JWX\JWE\CompressionAlgorithm; |
6 | 6 |
@@ -17,127 +17,127 @@ |
||
17 | 17 | */ |
18 | 18 | abstract class KeyManagementAlgorithm implements AlgorithmParameterValue, HeaderParameters |
19 | 19 | { |
20 | - /** |
|
21 | - * ID of the key used by the algorithm. |
|
22 | - * |
|
23 | - * If set, KeyID parameter shall be automatically inserted into JWE's |
|
24 | - * header. |
|
25 | - * |
|
26 | - * @var null|string |
|
27 | - */ |
|
28 | - protected $_keyID; |
|
20 | + /** |
|
21 | + * ID of the key used by the algorithm. |
|
22 | + * |
|
23 | + * If set, KeyID parameter shall be automatically inserted into JWE's |
|
24 | + * header. |
|
25 | + * |
|
26 | + * @var null|string |
|
27 | + */ |
|
28 | + protected $_keyID; |
|
29 | 29 | |
30 | - /** |
|
31 | - * Encrypt a key to be inserted into JWE header. |
|
32 | - * |
|
33 | - * @param string $cek Content encryption key |
|
34 | - * @param null|Header $header Optional reference to the Header variable, |
|
35 | - * which may be updated to contain parameters |
|
36 | - * specific to this encrypt invocation. |
|
37 | - * If the variable is referenced, but is a null, |
|
38 | - * it shall be initialized to an empty Header. |
|
39 | - * |
|
40 | - * @throws \RuntimeException For generic errors |
|
41 | - * |
|
42 | - * @return string Encrypted key |
|
43 | - */ |
|
44 | - final public function encrypt(string $cek, Header &$header = null): string |
|
45 | - { |
|
46 | - if (!isset($header)) { |
|
47 | - $header = new Header(); |
|
48 | - } |
|
49 | - return $this->_encryptKey($cek, $header); |
|
50 | - } |
|
30 | + /** |
|
31 | + * Encrypt a key to be inserted into JWE header. |
|
32 | + * |
|
33 | + * @param string $cek Content encryption key |
|
34 | + * @param null|Header $header Optional reference to the Header variable, |
|
35 | + * which may be updated to contain parameters |
|
36 | + * specific to this encrypt invocation. |
|
37 | + * If the variable is referenced, but is a null, |
|
38 | + * it shall be initialized to an empty Header. |
|
39 | + * |
|
40 | + * @throws \RuntimeException For generic errors |
|
41 | + * |
|
42 | + * @return string Encrypted key |
|
43 | + */ |
|
44 | + final public function encrypt(string $cek, Header &$header = null): string |
|
45 | + { |
|
46 | + if (!isset($header)) { |
|
47 | + $header = new Header(); |
|
48 | + } |
|
49 | + return $this->_encryptKey($cek, $header); |
|
50 | + } |
|
51 | 51 | |
52 | - /** |
|
53 | - * Decrypt a CEK from the encrypted data. |
|
54 | - * |
|
55 | - * @param string $data Encrypted key |
|
56 | - * @param null|Header $header Optional header containing parameters |
|
57 | - * required to decrypt the key |
|
58 | - * |
|
59 | - * @throws \RuntimeException For generic errors |
|
60 | - * |
|
61 | - * @return string Content encryption key |
|
62 | - */ |
|
63 | - final public function decrypt(string $data, ?Header $header = null): string |
|
64 | - { |
|
65 | - if (!isset($header)) { |
|
66 | - $header = new Header(); |
|
67 | - } |
|
68 | - return $this->_decryptKey($data, $header); |
|
69 | - } |
|
52 | + /** |
|
53 | + * Decrypt a CEK from the encrypted data. |
|
54 | + * |
|
55 | + * @param string $data Encrypted key |
|
56 | + * @param null|Header $header Optional header containing parameters |
|
57 | + * required to decrypt the key |
|
58 | + * |
|
59 | + * @throws \RuntimeException For generic errors |
|
60 | + * |
|
61 | + * @return string Content encryption key |
|
62 | + */ |
|
63 | + final public function decrypt(string $data, ?Header $header = null): string |
|
64 | + { |
|
65 | + if (!isset($header)) { |
|
66 | + $header = new Header(); |
|
67 | + } |
|
68 | + return $this->_decryptKey($data, $header); |
|
69 | + } |
|
70 | 70 | |
71 | - /** |
|
72 | - * Get content encryption key for the encryption. |
|
73 | - * |
|
74 | - * Returned key may be random depending on the key management algorithm. |
|
75 | - * |
|
76 | - * @param int $length Required key size in bytes |
|
77 | - * |
|
78 | - * @return string |
|
79 | - */ |
|
80 | - abstract public function cekForEncryption(int $length): string; |
|
71 | + /** |
|
72 | + * Get content encryption key for the encryption. |
|
73 | + * |
|
74 | + * Returned key may be random depending on the key management algorithm. |
|
75 | + * |
|
76 | + * @param int $length Required key size in bytes |
|
77 | + * |
|
78 | + * @return string |
|
79 | + */ |
|
80 | + abstract public function cekForEncryption(int $length): string; |
|
81 | 81 | |
82 | - /** |
|
83 | - * Initialize key management algorithm from a JWK and a header. |
|
84 | - * |
|
85 | - * @param JWK $jwk |
|
86 | - * @param Header $header |
|
87 | - * |
|
88 | - * @return KeyManagementAlgorithm |
|
89 | - */ |
|
90 | - public static function fromJWK(JWK $jwk, Header $header): KeyManagementAlgorithm |
|
91 | - { |
|
92 | - $factory = new KeyAlgorithmFactory($header); |
|
93 | - return $factory->algoByKey($jwk); |
|
94 | - } |
|
82 | + /** |
|
83 | + * Initialize key management algorithm from a JWK and a header. |
|
84 | + * |
|
85 | + * @param JWK $jwk |
|
86 | + * @param Header $header |
|
87 | + * |
|
88 | + * @return KeyManagementAlgorithm |
|
89 | + */ |
|
90 | + public static function fromJWK(JWK $jwk, Header $header): KeyManagementAlgorithm |
|
91 | + { |
|
92 | + $factory = new KeyAlgorithmFactory($header); |
|
93 | + return $factory->algoByKey($jwk); |
|
94 | + } |
|
95 | 95 | |
96 | - /** |
|
97 | - * Get self with key ID. |
|
98 | - * |
|
99 | - * @param null|string $id Key ID or null to remove |
|
100 | - * |
|
101 | - * @return self |
|
102 | - */ |
|
103 | - public function withKeyID(?string $id): self |
|
104 | - { |
|
105 | - $obj = clone $this; |
|
106 | - $obj->_keyID = $id; |
|
107 | - return $obj; |
|
108 | - } |
|
96 | + /** |
|
97 | + * Get self with key ID. |
|
98 | + * |
|
99 | + * @param null|string $id Key ID or null to remove |
|
100 | + * |
|
101 | + * @return self |
|
102 | + */ |
|
103 | + public function withKeyID(?string $id): self |
|
104 | + { |
|
105 | + $obj = clone $this; |
|
106 | + $obj->_keyID = $id; |
|
107 | + return $obj; |
|
108 | + } |
|
109 | 109 | |
110 | - /** |
|
111 | - * {@inheritdoc} |
|
112 | - */ |
|
113 | - public function headerParameters(): array |
|
114 | - { |
|
115 | - $params = []; |
|
116 | - if (isset($this->_keyID)) { |
|
117 | - $params[] = new KeyIDParameter($this->_keyID); |
|
118 | - } |
|
119 | - return $params; |
|
120 | - } |
|
110 | + /** |
|
111 | + * {@inheritdoc} |
|
112 | + */ |
|
113 | + public function headerParameters(): array |
|
114 | + { |
|
115 | + $params = []; |
|
116 | + if (isset($this->_keyID)) { |
|
117 | + $params[] = new KeyIDParameter($this->_keyID); |
|
118 | + } |
|
119 | + return $params; |
|
120 | + } |
|
121 | 121 | |
122 | - /** |
|
123 | - * Encrypt a key. |
|
124 | - * |
|
125 | - * @param string $key Key to be encrypted |
|
126 | - * @param Header $header Reference to the Header variable, that shall |
|
127 | - * be updated to contain parameters specific to the encryption |
|
128 | - * |
|
129 | - * @return string Ciphertext |
|
130 | - */ |
|
131 | - abstract protected function _encryptKey(string $key, Header &$header): string; |
|
122 | + /** |
|
123 | + * Encrypt a key. |
|
124 | + * |
|
125 | + * @param string $key Key to be encrypted |
|
126 | + * @param Header $header Reference to the Header variable, that shall |
|
127 | + * be updated to contain parameters specific to the encryption |
|
128 | + * |
|
129 | + * @return string Ciphertext |
|
130 | + */ |
|
131 | + abstract protected function _encryptKey(string $key, Header &$header): string; |
|
132 | 132 | |
133 | - /** |
|
134 | - * Decrypt a key. |
|
135 | - * |
|
136 | - * @param string $ciphertext Ciphertext of the encrypted key |
|
137 | - * @param Header $header Header possibly containing encoding specific |
|
138 | - * parameters |
|
139 | - * |
|
140 | - * @return string Plaintext key |
|
141 | - */ |
|
142 | - abstract protected function _decryptKey(string $ciphertext, Header $header): string; |
|
133 | + /** |
|
134 | + * Decrypt a key. |
|
135 | + * |
|
136 | + * @param string $ciphertext Ciphertext of the encrypted key |
|
137 | + * @param Header $header Header possibly containing encoding specific |
|
138 | + * parameters |
|
139 | + * |
|
140 | + * @return string Plaintext key |
|
141 | + */ |
|
142 | + abstract protected function _decryptKey(string $ciphertext, Header $header): string; |
|
143 | 143 | } |
@@ -1,6 +1,6 @@ |
||
1 | 1 | <?php |
2 | 2 | |
3 | -declare(strict_types = 1); |
|
3 | +declare(strict_types=1); |
|
4 | 4 | |
5 | 5 | namespace Sop\JWX\JWE; |
6 | 6 |
@@ -1,6 +1,6 @@ |
||
1 | 1 | <?php |
2 | 2 | |
3 | -declare(strict_types = 1); |
|
3 | +declare(strict_types=1); |
|
4 | 4 | |
5 | 5 | namespace Sop\JWX\JWE\Exception; |
6 | 6 |