ezcache / includes / Utilities / Encrypter.php

Encrypter.php in ezCache 1.3.11, at includes/Utilities/Encrypter.php

132 lines 3.2 KB

Raw Download Zip

1	<?php
2
3	namespace Upress\EzCache\Utilities;
4
5	use ErrorException;
6	use RuntimeException;
7
8	class Encrypter {
9	/*
10	* Encrypter class adapted from Laravel's Illuminate\Encryption\Encrypter
11	*/
12
13
14	/**
15	* The encryption key.
16	*
17	* @var string
18	*/
19	protected $key;
20
21	protected $method = 'AES-256-CBC';
22
23	function __construct() {
24	$this->key = defined( 'AUTH_KEY' ) ? AUTH_KEY : hash( 'sha256', 'g^%Zth*%Km88-DdTrSFMNsNb&S77d4pu' );
25	}
26
27	/**
28	* Encrypt the given value.
29	*
30	* @param mixed $value
31	*
32	* @return string
33	*/
34	public function encrypt( $value ) {
35	$iv = openssl_random_pseudo_bytes( openssl_cipher_iv_length( $this->method ) );
36
37	$value = serialize( $value );
38	$value = base64_encode( openssl_encrypt( $value, $this->method, $this->key, 0, $iv ) );
39
40	// Once we have the encrypted value we will go ahead base64_encode the input
41	// vector and create the MAC for the encrypted value so we can verify its
42	// authenticity. Then, we'll JSON encode the data in a "payload" array.
43	$mac = $this->hash( $iv = base64_encode( $iv ), $value );
44
45	return base64_encode( json_encode( compact( 'iv', 'value', 'mac' ) ) );
46	}
47
48	/**
49	* Decrypt the given value.
50	*
51	* @param string $payload
52	*
53	* @return mixed
54	* @throws ErrorException
55	*/
56	public function decrypt( $payload ) {
57	$payload = $this->getJsonPayload( $payload );
58
59	$value = base64_decode( $payload['value'] );
60	$iv = base64_decode( $payload['iv'] );
61
62	$decrypted = openssl_decrypt( $value, $this->method, $this->key, false, $iv );
63
64	return unserialize( $decrypted );
65	}
66
67
68	/**
69	* Get the JSON array from the given payload.
70	*
71	* @param string $payload
72	*
73	* @return array
74	*
75	* @throws ErrorException
76	*/
77	protected function getJsonPayload( $payload ) {
78	$payload = json_decode( base64_decode( $payload ), true );
79
80	// If the payload is not valid JSON or does not have the proper keys set we will
81	// assume it is invalid and bail out of the routine since we will not be able
82	// to decrypt the given value. We'll also check the MAC for this encryption.
83	if ( ! $payload \|\| $this->invalidPayload( $payload ) ) {
84	throw new ErrorException( 'Invalid data.' );
85	}
86
87	if ( ! $this->validMac( $payload ) ) {
88	throw new ErrorException( 'MAC is invalid.' );
89	}
90
91	return $payload;
92	}
93
94	/**
95	* Determine if the MAC for the given payload is valid.
96	*
97	* @param array $payload
98	*
99	* @return bool
100	*
101	* @throws RuntimeException
102	*/
103	protected function validMac( array $payload ) {
104	$calcMac = $this->hash( $payload['iv'], $payload['value'] );
105
106	return hash_equals( $calcMac, $payload['mac'] );
107	}
108
109	/**
110	* Create a MAC for the given value.
111	*
112	* @param string $iv
113	* @param string $value
114	*
115	* @return string
116	*/
117	protected function hash( $iv, $value ) {
118	return hash_hmac( 'sha256', $iv . $value, $this->key );
119	}
120
121	/**
122	* Verify that the encryption payload is valid.
123	*
124	* @param array\|mixed $data
125	*
126	* @return bool
127	*/
128	protected function invalidPayload( $data ) {
129	return ! is_array( $data ) \|\| ! isset( $data['iv'] ) \|\| ! isset( $data['value'] ) \|\| ! isset( $data['mac'] );
130	}
131	}
132