| 1 |
<?php |
| 2 |
|
| 3 |
namespace Dudlewebs\WPMCS\s3\Aws\Crypto; |
| 4 |
|
| 5 |
use Dudlewebs\WPMCS\s3\GuzzleHttp\Psr7; |
| 6 |
use Dudlewebs\WPMCS\s3\GuzzleHttp\Psr7\LimitStream; |
| 7 |
use Dudlewebs\WPMCS\s3\Psr\Http\Message\StreamInterface; |
| 8 |
trait DecryptionTrait |
| 9 |
{ |
| 10 |
/** |
| 11 |
* Dependency to reverse lookup the openssl_* cipher name from the AESName |
| 12 |
* in the MetadataEnvelope. |
| 13 |
* |
| 14 |
* @param $aesName |
| 15 |
* |
| 16 |
* @return string |
| 17 |
* |
| 18 |
* @internal |
| 19 |
*/ |
| 20 |
protected abstract function getCipherFromAesName($aesName); |
| 21 |
/** |
| 22 |
* Dependency to generate a CipherMethod from a set of inputs for loading |
| 23 |
* in to an AesDecryptingStream. |
| 24 |
* |
| 25 |
* @param string $cipherName Name of the cipher to generate for decrypting. |
| 26 |
* @param string $iv Base Initialization Vector for the cipher. |
| 27 |
* @param int $keySize Size of the encryption key, in bits, that will be |
| 28 |
* used. |
| 29 |
* |
| 30 |
* @return Cipher\CipherMethod |
| 31 |
* |
| 32 |
* @internal |
| 33 |
*/ |
| 34 |
protected abstract function buildCipherMethod($cipherName, $iv, $keySize); |
| 35 |
/** |
| 36 |
* Builds an AesStreamInterface using cipher options loaded from the |
| 37 |
* MetadataEnvelope and MaterialsProvider. Can decrypt data from both the |
| 38 |
* legacy and V2 encryption client workflows. |
| 39 |
* |
| 40 |
* @param string $cipherText Plain-text data to be encrypted using the |
| 41 |
* materials, algorithm, and data provided. |
| 42 |
* @param MaterialsProviderInterface $provider A provider to supply and encrypt |
| 43 |
* materials used in encryption. |
| 44 |
* @param MetadataEnvelope $envelope A storage envelope for encryption |
| 45 |
* metadata to be read from. |
| 46 |
* @param array $cipherOptions Additional verification options. |
| 47 |
* |
| 48 |
* @return AesStreamInterface |
| 49 |
* |
| 50 |
* @throws \InvalidArgumentException Thrown when a value in $cipherOptions |
| 51 |
* is not valid. |
| 52 |
* |
| 53 |
* @internal |
| 54 |
*/ |
| 55 |
public function decrypt($cipherText, MaterialsProviderInterface $provider, MetadataEnvelope $envelope, array $cipherOptions = []) |
| 56 |
{ |
| 57 |
$cipherOptions['Iv'] = \base64_decode($envelope[MetadataEnvelope::IV_HEADER]); |
| 58 |
$cipherOptions['TagLength'] = $envelope[MetadataEnvelope::CRYPTO_TAG_LENGTH_HEADER] / 8; |
| 59 |
$cek = $provider->decryptCek(\base64_decode($envelope[MetadataEnvelope::CONTENT_KEY_V2_HEADER]), \json_decode($envelope[MetadataEnvelope::MATERIALS_DESCRIPTION_HEADER], \true)); |
| 60 |
$cipherOptions['KeySize'] = \strlen($cek) * 8; |
| 61 |
$cipherOptions['Cipher'] = $this->getCipherFromAesName($envelope[MetadataEnvelope::CONTENT_CRYPTO_SCHEME_HEADER]); |
| 62 |
$decryptionStream = $this->getDecryptingStream($cipherText, $cek, $cipherOptions); |
| 63 |
unset($cek); |
| 64 |
return $decryptionStream; |
| 65 |
} |
| 66 |
private function getTagFromCiphertextStream(StreamInterface $cipherText, $tagLength) |
| 67 |
{ |
| 68 |
$cipherTextSize = $cipherText->getSize(); |
| 69 |
if ($cipherTextSize == null || $cipherTextSize <= 0) { |
| 70 |
throw new \RuntimeException('Cannot decrypt a stream of unknown' . ' size.'); |
| 71 |
} |
| 72 |
return (string) new LimitStream($cipherText, $tagLength, $cipherTextSize - $tagLength); |
| 73 |
} |
| 74 |
private function getStrippedCiphertextStream(StreamInterface $cipherText, $tagLength) |
| 75 |
{ |
| 76 |
$cipherTextSize = $cipherText->getSize(); |
| 77 |
if ($cipherTextSize == null || $cipherTextSize <= 0) { |
| 78 |
throw new \RuntimeException('Cannot decrypt a stream of unknown' . ' size.'); |
| 79 |
} |
| 80 |
return new LimitStream($cipherText, $cipherTextSize - $tagLength, 0); |
| 81 |
} |
| 82 |
/** |
| 83 |
* Generates a stream that wraps the cipher text with the proper cipher and |
| 84 |
* uses the content encryption key (CEK) to decrypt the data when read. |
| 85 |
* |
| 86 |
* @param string $cipherText Plain-text data to be encrypted using the |
| 87 |
* materials, algorithm, and data provided. |
| 88 |
* @param string $cek A content encryption key for use by the stream for |
| 89 |
* encrypting the plaintext data. |
| 90 |
* @param array $cipherOptions Options for use in determining the cipher to |
| 91 |
* be used for encrypting data. |
| 92 |
* |
| 93 |
* @return AesStreamInterface |
| 94 |
* |
| 95 |
* @internal |
| 96 |
*/ |
| 97 |
protected function getDecryptingStream($cipherText, $cek, $cipherOptions) |
| 98 |
{ |
| 99 |
$cipherTextStream = Psr7\Utils::streamFor($cipherText); |
| 100 |
switch ($cipherOptions['Cipher']) { |
| 101 |
case 'gcm': |
| 102 |
$cipherOptions['Tag'] = $this->getTagFromCiphertextStream($cipherTextStream, $cipherOptions['TagLength']); |
| 103 |
return new AesGcmDecryptingStream($this->getStrippedCiphertextStream($cipherTextStream, $cipherOptions['TagLength']), $cek, $cipherOptions['Iv'], $cipherOptions['Tag'], $cipherOptions['Aad'] = isset($cipherOptions['Aad']) ? $cipherOptions['Aad'] : null, $cipherOptions['TagLength'] ?: null, $cipherOptions['KeySize']); |
| 104 |
default: |
| 105 |
$cipherMethod = $this->buildCipherMethod($cipherOptions['Cipher'], $cipherOptions['Iv'], $cipherOptions['KeySize']); |
| 106 |
return new AesDecryptingStream($cipherTextStream, $cek, $cipherMethod); |
| 107 |
} |
| 108 |
} |
| 109 |
} |
| 110 |
|
