Skip to content

Commit abd7bf5

Browse files
unixslayerunixslayer
committed
- pipeline fix
- remove defuse legacy as it does not apply
1 parent 790fff1 commit abd7bf5

File tree

12 files changed

+42
-162
lines changed

12 files changed

+42
-162
lines changed

‎composer.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -125,6 +125,7 @@
125125
"ext-openssl": "*",
126126
"doctrine/dbal": "^3.9|^4.0",
127127
"doctrine/persistence": "^2.5|^3.4",
128+
"defuse/php-encryption": "^2.4",
128129
"enqueue/amqp-lib": "^0.10.25",
129130
"enqueue/redis": "^0.10.9",
130131
"enqueue/sqs": "^0.10.15",

‎packages/DataProtection/composer.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@
3939
"ext-openssl": "*",
4040
"ecotone/ecotone": "~1.299.2",
4141
"ecotone/jms-converter": "~1.299.2",
42-
"ecotone/php-encryption": "~1.299.2"
42+
"defuse/php-encryption": "^2.4"
4343
},
4444
"require-dev": {
4545
"phpunit/phpunit": "^9.5|^10.5|^11.0",

‎packages/PHPEncryption/composer.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@
4444
"paragonie/random_compat": "^2.0"
4545
},
4646
"require-dev": {
47-
"phpstan/phpstan": "^1.8",
47+
"phpstan/phpstan": "^2.1",
4848
"phpunit/phpunit": "^11",
4949
"yoast/phpunit-polyfills": "^4.0.0"
5050
},

‎packages/PHPEncryption/docs/CryptoDetails.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,8 +26,8 @@ Let's start with the following definitions:
2626
- *i*: The iteration count.
2727
- *n*: The output length in bytes.
2828
- VERSION is the string `"\xDE\xF5\x02\x00"`.
29-
- AUTHINFO is the string `"Ecotone|V2|KeyForAuthentication"`.
30-
- ENCRINFO is the string `"Ecotone|V2|KeyForEncryption"`.
29+
- AUTHINFO is the string `"Ecotone|KeyForAuthentication"`.
30+
- ENCRINFO is the string `"Ecotone|KeyForEncryption"`.
3131

3232
To encrypt a message *m* using a 32-byte key *k*, the following steps are taken:
3333

‎packages/PHPEncryption/src/Core.php‎

Lines changed: 15 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -38,28 +38,20 @@
3838
*/
3939
final class Core
4040
{
41-
public const int HEADER_VERSION_SIZE = 4;
42-
public const int MINIMUM_CIPHERTEXT_SIZE = 84;
43-
44-
public const string CURRENT_VERSION = "\xDE\xF5\x02\x00";
45-
46-
public const string CIPHER_METHOD = 'aes-256-ctr';
47-
public const int BLOCK_BYTE_SIZE = 16;
48-
public const int KEY_BYTE_SIZE = 32;
49-
public const int SALT_BYTE_SIZE = 32;
50-
public const int MAC_BYTE_SIZE = 32;
51-
public const string HASH_FUNCTION_NAME = 'sha256';
52-
public const string ENCRYPTION_INFO_STRING = 'Ecotone|V2|KeyForEncryption';
53-
public const string AUTHENTICATION_INFO_STRING = 'Ecotone|V2|KeyForAuthentication';
54-
public const int BUFFER_BYTE_SIZE = 1048576;
55-
56-
public const string LEGACY_CIPHER_METHOD = 'aes-128-cbc';
57-
public const int LEGACY_BLOCK_BYTE_SIZE = 16;
58-
public const int LEGACY_KEY_BYTE_SIZE = 16;
59-
public const string LEGACY_HASH_FUNCTION_NAME = 'sha256';
60-
public const int LEGACY_MAC_BYTE_SIZE = 32;
61-
public const string LEGACY_ENCRYPTION_INFO_STRING = 'Ecotone|KeyForEncryption';
62-
public const string LEGACY_AUTHENTICATION_INFO_STRING = 'Ecotone|KeyForAuthentication';
41+
public const HEADER_VERSION_SIZE = 4;
42+
public const MINIMUM_CIPHERTEXT_SIZE = 84;
43+
44+
public const CURRENT_VERSION = "\xDE\xF5\x02\x00";
45+
46+
public const CIPHER_METHOD = 'aes-256-ctr';
47+
public const BLOCK_BYTE_SIZE = 16;
48+
public const KEY_BYTE_SIZE = 32;
49+
public const SALT_BYTE_SIZE = 32;
50+
public const MAC_BYTE_SIZE = 32;
51+
public const HASH_FUNCTION_NAME = 'sha256';
52+
public const ENCRYPTION_INFO_STRING = 'Ecotone|KeyForEncryption';
53+
public const AUTHENTICATION_INFO_STRING = 'Ecotone|KeyForAuthentication';
54+
public const BUFFER_BYTE_SIZE = 1048576;
6355

6456
/*
6557
* V2.0 Format: VERSION (4 bytes) || SALT (32 bytes) || IV (16 bytes) ||
@@ -78,7 +70,6 @@ final class Core
7870
public static function incrementCounter(string $ctr, int $inc): string
7971
{
8072
self::ensureTrue(self::strlen($ctr) === self::BLOCK_BYTE_SIZE, 'Trying to increment a nonce of the wrong size.');
81-
self::ensureTrue(is_int($inc), 'Trying to increment nonce by a non-integer.');
8273
self::ensureTrue($inc > 0, 'Trying to increment a nonce by a nonpositive amount'); // The caller is probably re-using CTR-mode keystream if they increment by 0.
8374
self::ensureTrue($inc <= PHP_INT_MAX - 255, 'Integer overflow may occur');
8475

@@ -141,7 +132,7 @@ public static function HKDF(string $hash, string $ikm, int $length, string $info
141132
$digest_length = self::strlen(hash_hmac($hash, '', '', true));
142133

143134
// Sanity-check the desired output length.
144-
self::ensureTrue(! empty($length) && is_int($length) && $length >= 0 && $length <= 255 * $digest_length, 'Bad output length requested of HDKF.');
135+
self::ensureTrue(! empty($length) && $length >= 0 && $length <= 255 * $digest_length, 'Bad output length requested of HDKF.');
145136

146137
// "if [salt] not provided, is set to a string of HashLen zeroes."
147138
if (is_null($salt)) {

‎packages/PHPEncryption/src/Crypto.php‎

Lines changed: 3 additions & 57 deletions
Original file line numberDiff line numberDiff line change
@@ -5,14 +5,15 @@
55
use Ecotone\PHPEncryption\Exception\CryptoException;
66
use Ecotone\PHPEncryption\Exception\EnvironmentIsBrokenException;
77
use Ecotone\PHPEncryption\Exception\WrongKeyOrModifiedCiphertextException;
8-
use SensitiveParameter;
9-
use Throwable;
108

119
use function hash_hmac;
1210
use function is_string;
1311
use function openssl_decrypt;
1412
use function openssl_encrypt;
1513

14+
use SensitiveParameter;
15+
use Throwable;
16+
1617
/**
1718
* licence Apache-2.0
1819
*/
@@ -58,61 +59,6 @@ public static function decryptWithPassword(string $ciphertext, #[SensitiveParame
5859
return self::decryptInternal($ciphertext, KeyOrPassword::createFromPassword($password), $raw_binary);
5960
}
6061

61-
/**
62-
* Decrypts a legacy ciphertext produced by version 1 of this library.
63-
*
64-
* @throws WrongKeyOrModifiedCiphertextException|EnvironmentIsBrokenException
65-
*/
66-
public static function legacyDecrypt(string $ciphertext, #[SensitiveParameter] string $key): string
67-
{
68-
RuntimeTests::runtimeTest();
69-
70-
// Extract the HMAC from the front of the ciphertext.
71-
if (Core::strlen($ciphertext) <= Core::LEGACY_MAC_BYTE_SIZE) {
72-
throw new WrongKeyOrModifiedCiphertextException('Ciphertext is too short.');
73-
}
74-
75-
$hmac = Core::substr($ciphertext, 0, Core::LEGACY_MAC_BYTE_SIZE);
76-
Core::ensureTrue(is_string($hmac));
77-
78-
$messageCiphertext = Core::substr($ciphertext, Core::LEGACY_MAC_BYTE_SIZE);
79-
Core::ensureTrue(is_string($messageCiphertext));
80-
81-
// Regenerate the same authentication sub-key.
82-
$akey = Core::HKDF(
83-
hash: Core::LEGACY_HASH_FUNCTION_NAME,
84-
ikm: $key,
85-
length: Core::LEGACY_KEY_BYTE_SIZE,
86-
info: Core::LEGACY_AUTHENTICATION_INFO_STRING,
87-
);
88-
89-
if (self::verifyHMAC($hmac, $messageCiphertext, $akey)) {
90-
// Regenerate the same encryption sub-key.
91-
$ekey = Core::HKDF(
92-
hash: Core::LEGACY_HASH_FUNCTION_NAME,
93-
ikm: $key,
94-
length: Core::LEGACY_KEY_BYTE_SIZE,
95-
info: Core::LEGACY_ENCRYPTION_INFO_STRING,
96-
);
97-
98-
// Extract the IV from the ciphertext.
99-
if (Core::strlen($messageCiphertext) <= Core::LEGACY_BLOCK_BYTE_SIZE) {
100-
throw new WrongKeyOrModifiedCiphertextException('Ciphertext is too short.');
101-
}
102-
103-
$iv = Core::substr($messageCiphertext, 0, Core::LEGACY_BLOCK_BYTE_SIZE);
104-
Core::ensureTrue(is_string($iv));
105-
106-
$actualCiphertext = Core::substr($messageCiphertext, Core::LEGACY_BLOCK_BYTE_SIZE);
107-
Core::ensureTrue(is_string($actualCiphertext));
108-
109-
// Do the decryption.
110-
return self::plainDecrypt($actualCiphertext, $ekey, $iv, Core::LEGACY_CIPHER_METHOD);
111-
}
112-
113-
throw new WrongKeyOrModifiedCiphertextException('Integrity check failed.');
114-
}
115-
11662
/**
11763
* Encrypts a string with either a key or a password.
11864
*

‎packages/PHPEncryption/src/Encoding.php‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,20 +5,21 @@
55
use Ecotone\PHPEncryption\Exception\BadFormatException;
66
use Ecotone\PHPEncryption\Exception\CryptoException;
77
use Ecotone\PHPEncryption\Exception\EnvironmentIsBrokenException;
8-
use SensitiveParameter;
98

109
use function hash;
1110
use function ord;
1211
use function pack;
1312

13+
use SensitiveParameter;
14+
1415
/**
1516
* licence Apache-2.0
1617
*/
1718
final class Encoding
1819
{
19-
public const int CHECKSUM_BYTE_SIZE = 32;
20-
public const string CHECKSUM_HASH_ALGO = 'sha256';
21-
public const int SERIALIZE_HEADER_BYTES = 4;
20+
public const CHECKSUM_BYTE_SIZE = 32;
21+
public const CHECKSUM_HASH_ALGO = 'sha256';
22+
public const SERIALIZE_HEADER_BYTES = 4;
2223

2324
/**
2425
* Converts a byte string to a hexadecimal string without leaking information through side channels.

‎packages/PHPEncryption/src/File.php‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ final class File
4040
/**
4141
* Encrypts the input file, saving the ciphertext to the output file.
4242
*
43-
* @throws IOException
43+
* @throws IOException|EnvironmentIsBrokenException
4444
*/
4545
public static function encryptFile(string $inputFilename, string $outputFilename, Key $key): void
4646
{
@@ -50,7 +50,7 @@ public static function encryptFile(string $inputFilename, string $outputFilename
5050
/**
5151
* Encrypts a file with a password, using a slow key derivation function to make password cracking more expensive.
5252
*
53-
* @throws IOException
53+
* @throws IOException|EnvironmentIsBrokenException
5454
*/
5555
public static function encryptFileWithPassword(string $inputFilename, string $outputFilename, #[SensitiveParameter] string $password): void
5656
{
@@ -64,7 +64,7 @@ public static function encryptFileWithPassword(string $inputFilename, string $ou
6464
/**
6565
* Decrypts the input file, saving the plaintext to the output file.
6666
*
67-
* @throws IOException
67+
* @throws CryptoException|EnvironmentIsBrokenException|IOException|WrongKeyOrModifiedCiphertextException
6868
*/
6969
public static function decryptFile(string $inputFilename, string $outputFilename, Key $key): void
7070
{
@@ -74,7 +74,7 @@ public static function decryptFile(string $inputFilename, string $outputFilename
7474
/**
7575
* Decrypts a file with a password, using a slow key derivation function to make password cracking more expensive.
7676
*
77-
* @throws IOException
77+
* @throws CryptoException|EnvironmentIsBrokenException|IOException|WrongKeyOrModifiedCiphertextException
7878
*/
7979
public static function decryptFileWithPassword(string $inputFilename, string $outputFilename, #[SensitiveParameter] string $password): void
8080
{
@@ -84,7 +84,7 @@ public static function decryptFileWithPassword(string $inputFilename, string $ou
8484
/**
8585
* Takes two resource handles and encrypts the contents of the first, writing the ciphertext into the second.
8686
*
87-
* @throws EnvironmentIsBrokenException|IOException
87+
* @throws CryptoException|EnvironmentIsBrokenException|IOException|WrongKeyOrModifiedCiphertextException
8888
*/
8989
public static function encryptResource($inputHandle, $outputHandle, Key $key): void
9090
{
@@ -94,7 +94,7 @@ public static function encryptResource($inputHandle, $outputHandle, Key $key): v
9494
/**
9595
* Encrypts the contents of one resource handle into another with a password, using a slow key derivation function to make password cracking more expensive.
9696
*
97-
* @throws EnvironmentIsBrokenException|IOException
97+
* @throws CryptoException|EnvironmentIsBrokenException|IOException|WrongKeyOrModifiedCiphertextException
9898
*/
9999
public static function encryptResourceWithPassword($inputHandle, $outputHandle, #[SensitiveParameter] string $password): void
100100
{
@@ -124,7 +124,7 @@ public static function decryptResourceWithPassword($inputHandle, $outputHandle,
124124
/**
125125
* Encrypts a file with either a key or a password.
126126
*
127-
* @throws IOException|EnvironmentIsBrokenException
127+
* @throws CryptoException|EnvironmentIsBrokenException|IOException|WrongKeyOrModifiedCiphertextException
128128
*/
129129
private static function encryptFileInternal(string $inputFilename, string $outputFilename, KeyOrPassword $secret): void
130130
{

‎packages/PHPEncryption/src/Key.php‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,8 @@
1212
*/
1313
final class Key
1414
{
15-
public const string KEY_CURRENT_VERSION = "\xDE\xF0\x00\x00";
16-
public const int KEY_BYTE_SIZE = 32;
15+
public const KEY_CURRENT_VERSION = "\xDE\xF0\x00\x00";
16+
public const KEY_BYTE_SIZE = 32;
1717

1818
private string $key_bytes;
1919

@@ -46,7 +46,7 @@ public static function createNewRandomKey(): self
4646
*
4747
* @throws CryptoException|EnvironmentIsBrokenException|BadFormatException
4848
*/
49-
public static function loadFromAsciiSafeString(#[SensitiveParameter]string $saved_key_string, bool $do_not_trim = false): self
49+
public static function loadFromAsciiSafeString(#[SensitiveParameter] string $saved_key_string, bool $do_not_trim = false): self
5050
{
5151
if (! $do_not_trim) {
5252
$saved_key_string = Encoding::trimTrailingWhitespace($saved_key_string);

‎packages/PHPEncryption/src/KeyOrPassword.php‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -14,9 +14,9 @@
1414
*/
1515
final class KeyOrPassword
1616
{
17-
public const int PBKDF2_ITERATIONS = 100000;
18-
public const int SECRET_TYPE_KEY = 1;
19-
public const int SECRET_TYPE_PASSWORD = 2;
17+
public const PBKDF2_ITERATIONS = 100000;
18+
public const SECRET_TYPE_KEY = 1;
19+
public const SECRET_TYPE_PASSWORD = 2;
2020

2121
private int $secret_type;
2222
private Key|string $secret;

0 commit comments

Comments
 (0)