defender-security / vendor / web-token / jwt-core / Util / KeyChecker.php

KeyChecker.php in Defender Security – Malware Scanner, Login Security & Firewall 5.8.1, at vendor/web-token/jwt-core/Util/KeyChecker.php

122 lines 3.5 KB

Raw Download Zip

1	<?php
2
3	declare(strict_types=1);
4
5	/*
6	* The MIT License (MIT)
7	*
8	* Copyright (c) 2014-2020 Spomky-Labs
9	*
10	* This software may be modified and distributed under the terms
11	* of the MIT license. See the LICENSE file for details.
12	*/
13
14	namespace Jose\Component\Core\Util;
15
16	use function in_array;
17	use InvalidArgumentException;
18	use function is_array;
19	use Jose\Component\Core\JWK;
20
21	/**
22	* @internal
23	*/
24	class KeyChecker
25	{
26	public static function checkKeyUsage(JWK $key, string $usage): void
27	{
28	if ($key->has('use')) {
29	self::checkUsage($key, $usage);
30	}
31	if ($key->has('key_ops')) {
32	self::checkOperation($key, $usage);
33	}
34	}
35
36	/**
37	* @throws InvalidArgumentException if the key is not suitable for the selected algorithm
38	*/
39	public static function checkKeyAlgorithm(JWK $key, string $algorithm): void
40	{
41	if (!$key->has('alg')) {
42	return;
43	}
44	if ($key->get('alg') !== $algorithm) {
45	throw new InvalidArgumentException(sprintf('Key is only allowed for algorithm "%s".', $key->get('alg')));
46	}
47	}
48
49	/**
50	* @throws InvalidArgumentException if the key is not suitable for the selected operation
51	*/
52	private static function checkOperation(JWK $key, string $usage): void
53	{
54	$ops = $key->get('key_ops');
55	if (!is_array($ops)) {
56	throw new InvalidArgumentException('Invalid key parameter "key_ops". Should be a list of key operations');
57	}
58
59	switch ($usage) {
60	case 'verification':
61	if (!in_array('verify', $ops, true)) {
62	throw new InvalidArgumentException('Key cannot be used to verify a signature');
63	}
64
65	break;
66
67	case 'signature':
68	if (!in_array('sign', $ops, true)) {
69	throw new InvalidArgumentException('Key cannot be used to sign');
70	}
71
72	break;
73
74	case 'encryption':
75	if (!in_array('encrypt', $ops, true) && !in_array('wrapKey', $ops, true) && !in_array('deriveKey', $ops, true)) {
76	throw new InvalidArgumentException('Key cannot be used to encrypt');
77	}
78
79	break;
80
81	case 'decryption':
82	if (!in_array('decrypt', $ops, true) && !in_array('unwrapKey', $ops, true) && !in_array('deriveBits', $ops, true)) {
83	throw new InvalidArgumentException('Key cannot be used to decrypt');
84	}
85
86	break;
87
88	default:
89	throw new InvalidArgumentException('Unsupported key usage.');
90	}
91	}
92
93	/**
94	* @throws InvalidArgumentException if the key is not suitable for the selected operation
95	*/
96	private static function checkUsage(JWK $key, string $usage): void
97	{
98	$use = $key->get('use');
99
100	switch ($usage) {
101	case 'verification':
102	case 'signature':
103	if ('sig' !== $use) {
104	throw new InvalidArgumentException('Key cannot be used to sign or verify a signature.');
105	}
106
107	break;
108
109	case 'encryption':
110	case 'decryption':
111	if ('enc' !== $use) {
112	throw new InvalidArgumentException('Key cannot be used to encrypt or decrypt.');
113	}
114
115	break;
116
117	default:
118	throw new InvalidArgumentException('Unsupported key usage.');
119	}
120	}
121	}
122