wfCrypt.php — Wordfence Security – Firewall, Malware Scan, and Login Security 7.3.2

wordfence / lib / wfCrypt.php

wordfence / lib Last commit date

wfCrypt.php

77 lines

1	<?php
2	class wfCrypt {
3	private static function getPubKey(){
4	#Command to generate our keypair was: openssl req -x509 -newkey rsa:2048 -keyout mycert.key -out mycert.pem -nodes -subj "/C=US/ST=Washington/L=Seattle/O=Wordfence/OU=IT/CN=wordfence.com" -days 7300
5	#This is a 2048 bit key using SHA256 with RSA.
6	$key = <<<ENDKEY
7	-----BEGIN CERTIFICATE-----
8	MIIDrTCCApWgAwIBAgIJAIg6Va5tcvwyMA0GCSqGSIb3DQEBCwUAMG0xCzAJBgNV
9	BAYTAlVTMRMwEQYDVQQIDApXYXNoaW5ndG9uMRAwDgYDVQQHDAdTZWF0dGxlMRIw
10	EAYDVQQKDAlXb3JkZmVuY2UxCzAJBgNVBAsMAklUMRYwFAYDVQQDDA13b3JkZmVu
11	Y2UuY29tMB4XDTE1MDMxMjA1NTIzMFoXDTM1MDMwNzA1NTIzMFowbTELMAkGA1UE
12	BhMCVVMxEzARBgNVBAgMCldhc2hpbmd0b24xEDAOBgNVBAcMB1NlYXR0bGUxEjAQ
13	BgNVBAoMCVdvcmRmZW5jZTELMAkGA1UECwwCSVQxFjAUBgNVBAMMDXdvcmRmZW5j
14	ZS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC/9Ogj1PIQsuZu
15	dTUNWlG0zaDNWpeY1ZiB/6oBS/YXkGFuG8R/nZ/kYsRmBm6yRp/3jC/HiPjg+7Zc
16	bA/CKoHdUlNjFZ+10DmS369wVX+c0oV9f720b/a0xN0qeKxJTiN2NsAl5szYv2CQ
17	Bvzjeb5VfKgrfV9tgYr38swudxvexponYaK0OlDL3u/Xca4SLRKmB+ZYCcZJttoG
18	SNFsQMlLHWWmM0FJH9qZ3x8MtRM5KsNEWO+/op511Rr36ZnLJdzUnETsaxHKwuCv
19	0+D9b0mwk8K/c67l63v4+zywXNkdYIslgo7Aeeyb6t0lyyfruXutEyMinmApACT2
20	sDMAbYk7AgMBAAGjUDBOMB0GA1UdDgQWBBTstr/AoPQyLLIt4/peFSjj0FFXHzAf
21	BgNVHSMEGDAWgBTstr/AoPQyLLIt4/peFSjj0FFXHzAMBgNVHRMEBTADAQH/MA0G
22	CSqGSIb3DQEBCwUAA4IBAQA9HsK+XdZh2MGP2SDdggA+MxkNBCCFBtcsmQrpiLUW
23	67xt59FPRMwTgSA9Lt8uqcWaXoHXiaTnXTRtN/BKZR0F71HQfiV6zy511blIRlk2
24	nV+vYzwLUENCZ31hQEZsY+uYqBSTiHecUKohn8A9pOOEpis2YEn2zVo4cobdyGa1
25	zCnaAN99KT8s9lOO0UW0J52qZhvv4y8YhELtrXKBsFatGEsVIM0NFI+ZDsNpMnSQ
26	cmUtLiIJtk5hxNbOaIz2vzbOkbzJ3ehzODJ1X5rya7X0v2akLLhwP9jqz5ua6ttP
27	duLv4Q6v3LY6pwDoyKQMDqNNxVjaFmx5HyFWRPofpu/T
28	-----END CERTIFICATE-----
29	ENDKEY;
30	return $key;
31	}
32	public static function makeSymHexKey($length){
33	return bin2hex(wfWAFUtils::random_bytes($length / 2));
34	}
35	public static function pubCrypt($symKey){ //encrypts a symmetric key and returns it base64
36	openssl_public_encrypt($symKey, $encSymKey, self::getPubKey(), OPENSSL_PKCS1_OAEP_PADDING); //The default OPENSSL_PKCS1_PADDING is deprecated.
37	return base64_encode($encSymKey);
38	}
39
40	/**
41	* Returns the payload symmetrically encrypted and signed by the noc1 public key. The payload is converted to JSON,
42	* encrypted using a randomly-generated symmetric key, and then hashed and signed with the noc1 public key.
43	*
44	* This is NOT cryptographically secure for verifying that this server sent or was aware of the context of the
45	* message, rather it is intended to be used in tandem with verification via another method (e.g., a call that
46	* validates due to the site URL matching the license key or noc1 does a call itself to the server to retrieve the
47	* encrypted payload). It is solely a means to provide data to noc1 that only it can read.
48	*
49	* @param array $payload
50	* @return array The encrypted and signed payload in the form array('message' => <encrypted message in hex>, 'signature' => <signature in hex>).
51	*/
52	public static function noc1_encrypt($payload) {
53	$payloadJSON = json_encode($payload);
54
55	$keyData = file_get_contents(dirname(__FILE__) . '/noc1.key');
56	$key = @openssl_get_publickey($keyData);
57	if ($key !== false) {
58	$symmetricKey = wfWAFUtils::random_bytes(32);
59	$iv = wfWAFUtils::random_bytes(16);
60	$encrypted = @openssl_encrypt($payloadJSON, 'aes-256-cbc', $symmetricKey, OPENSSL_RAW_DATA, $iv);
61	if ($encrypted !== false) {
62	$success = openssl_public_encrypt($symmetricKey, $symmetricKeyEncrypted, $key, OPENSSL_PKCS1_OAEP_PADDING);
63	if ($success) {
64	$message = $iv . $symmetricKeyEncrypted . $encrypted;
65	$signatureRaw = hash('sha256', $message, true);
66	$success = openssl_public_encrypt($signatureRaw, $signature, $key, OPENSSL_PKCS1_OAEP_PADDING);
67	if ($success) {
68	$package = array('message' => bin2hex($message), 'signature' => bin2hex($signature));
69	return $package;
70	}
71	}
72	}
73	}
74	return array();
75	}
76	}
77