| 1 |
<?php |
| 2 |
|
| 3 |
declare(strict_types=1); |
| 4 |
|
| 5 |
/* |
| 6 |
* The MIT License (MIT) |
| 7 |
* |
| 8 |
* Copyright (c) 2014-2020 Spomky-Labs |
| 9 |
* |
| 10 |
* This software may be modified and distributed under the terms |
| 11 |
* of the MIT license. See the LICENSE file for details. |
| 12 |
*/ |
| 13 |
|
| 14 |
namespace Jose\Component\Signature\Algorithm; |
| 15 |
|
| 16 |
use Base64Url\Base64Url; |
| 17 |
use function extension_loaded; |
| 18 |
use function in_array; |
| 19 |
use InvalidArgumentException; |
| 20 |
use Jose\Component\Core\JWK; |
| 21 |
use RuntimeException; |
| 22 |
|
| 23 |
final class EdDSA implements SignatureAlgorithm |
| 24 |
{ |
| 25 |
/** |
| 26 |
* EdDSA constructor. |
| 27 |
* |
| 28 |
* @throws RuntimeException if the extension "sodium" is not available |
| 29 |
*/ |
| 30 |
public function __construct() |
| 31 |
{ |
| 32 |
if (!extension_loaded('sodium')) { |
| 33 |
throw new RuntimeException('The extension "sodium" is not available. Please install it to use this method'); |
| 34 |
} |
| 35 |
} |
| 36 |
|
| 37 |
public function allowedKeyTypes(): array |
| 38 |
{ |
| 39 |
return ['OKP']; |
| 40 |
} |
| 41 |
|
| 42 |
/** |
| 43 |
* @throws InvalidArgumentException if the key is not private |
| 44 |
* @throws InvalidArgumentException if the curve is not supported |
| 45 |
*/ |
| 46 |
public function sign(JWK $key, string $input): string |
| 47 |
{ |
| 48 |
$this->checkKey($key); |
| 49 |
if (!$key->has('d')) { |
| 50 |
throw new InvalidArgumentException('The EC key is not private'); |
| 51 |
} |
| 52 |
$x = Base64Url::decode($key->get('x')); |
| 53 |
$d = Base64Url::decode($key->get('d')); |
| 54 |
$secret = $d.$x; |
| 55 |
|
| 56 |
switch ($key->get('crv')) { |
| 57 |
case 'Ed25519': |
| 58 |
return sodium_crypto_sign_detached($input, $secret); |
| 59 |
|
| 60 |
default: |
| 61 |
throw new InvalidArgumentException('Unsupported curve'); |
| 62 |
} |
| 63 |
} |
| 64 |
|
| 65 |
/** |
| 66 |
* @throws InvalidArgumentException if the curve is not supported |
| 67 |
*/ |
| 68 |
public function verify(JWK $key, string $input, string $signature): bool |
| 69 |
{ |
| 70 |
$this->checkKey($key); |
| 71 |
|
| 72 |
$public = Base64Url::decode($key->get('x')); |
| 73 |
|
| 74 |
switch ($key->get('crv')) { |
| 75 |
case 'Ed25519': |
| 76 |
return sodium_crypto_sign_verify_detached($signature, $input, $public); |
| 77 |
|
| 78 |
default: |
| 79 |
throw new InvalidArgumentException('Unsupported curve'); |
| 80 |
} |
| 81 |
} |
| 82 |
|
| 83 |
public function name(): string |
| 84 |
{ |
| 85 |
return 'EdDSA'; |
| 86 |
} |
| 87 |
|
| 88 |
/** |
| 89 |
* @throws InvalidArgumentException if the key type is not valid |
| 90 |
* @throws InvalidArgumentException if a mandatory key parameter is missing |
| 91 |
* @throws InvalidArgumentException if the curve is not suuported |
| 92 |
*/ |
| 93 |
private function checkKey(JWK $key): void |
| 94 |
{ |
| 95 |
if (!in_array($key->get('kty'), $this->allowedKeyTypes(), true)) { |
| 96 |
throw new InvalidArgumentException('Wrong key type.'); |
| 97 |
} |
| 98 |
foreach (['x', 'crv'] as $k) { |
| 99 |
if (!$key->has($k)) { |
| 100 |
throw new InvalidArgumentException(sprintf('The key parameter "%s" is missing.', $k)); |
| 101 |
} |
| 102 |
} |
| 103 |
if ('Ed25519' !== $key->get('crv')) { |
| 104 |
throw new InvalidArgumentException('Unsupported curve.'); |
| 105 |
} |
| 106 |
} |
| 107 |
} |
| 108 |
|
