Encryption.php

Go to the documentation of this file.

<?php
namespace Ubiquity\security\data;
 
use Ubiquity\exceptions\EncryptException;
use Ubiquity\exceptions\DecryptException;
use Ubiquity\exceptions\EncryptionKeyException;
 
class Encryption {
 
    const AES128 = 'AES-128-CBC';
 
    const AES192 = 'AES-192-CBC';
 
    const AES256 = 'AES-256-CBC';
 
    private static $acceptedCiphers = [
        32 => self::AES128,
        48 => self::AES192,
        64 => self::AES256
    ];
 
    protected $key;
 
    protected $cipher;
 
    public function __construct(?string $key = null, ?string $cipher = null) {
        $this->key = $key;
        $this->cipher = $cipher;
    }
 
    public function initializeKeyAndCipher() {
        if (isset($this->key) && ! isset($this->cipher)) {
            $this->cipher = self::getCipherFromKey($this->key);
        } elseif (! isset($this->key)) {
            $this->cipher ??= self::AES128;
            $this->key = self::generateKey($this->cipher);
        }
        if (! self::isValidKey($this->key, $this->cipher)) {
            throw new EncryptionKeyException("The encryption key size is not valid for {$this->cipher}.");
        }
    }
 
    public static function getCipherFromKey(string $key) {
        $size = \strlen($key);
        if (isset(self::$acceptedCiphers[$size])) {
            return self::$acceptedCiphers[$size];
        }
        throw new EncryptionKeyException("The encryption key has not a valid size ({$size})");
    }
 
    protected function hash($iv, $value): string {
        return \hash_hmac('sha256', $iv . $value, $this->key);
    }
 
    protected function getJsonPayload($payload) {
        $payload = \json_decode(\base64_decode($payload), true);
        if (! $this->isValidPayload($payload)) {
            throw new DecryptException('The payload is invalid.');
        }
        if (! $this->isValidMac($payload)) {
            throw new DecryptException('The MAC control is invalid.');
        }
 
        return $payload;
    }
 
    protected function isValidPayload($payload) {
        return \is_array($payload) && isset($payload['iv'], $payload['value'], $payload['mac']) && \strlen(\base64_decode($payload['iv'], true)) === \openssl_cipher_iv_length($this->cipher);
    }
 
    protected function isValidMac(array $payload) {
        $calculated = $this->calculateMac($payload, $bytes = random_bytes(16));
        return \hash_equals(\hash_hmac('sha256', $payload['mac'], $bytes, true), $calculated);
    }
 
    protected function calculateMac($payload, $bytes) {
        return \hash_hmac('sha256', $this->hash($payload['iv'], $payload['value']), $bytes, true);
    }
 
    public function encrypt($value, $serialize = true): string {
        $iv = \random_bytes(\openssl_cipher_iv_length($this->cipher));
        $value = \openssl_encrypt($serialize ? \serialize($value) : $value, $this->cipher, $this->key, 0, $iv);
        if ($value === false) {
            throw new EncryptException('Could not encrypt the data with openssl.');
        }
 
        $mac = $this->hash($iv = base64_encode($iv), $value);
        $json = \json_encode(\compact('iv', 'value', 'mac'), JSON_UNESCAPED_SLASHES);
        if (\json_last_error() !== \JSON_ERROR_NONE) {
            throw new EncryptException('Could not json_encode the data.');
        }
 
        return \base64_encode($json);
    }
 
    public function encryptString(string $value): string {
        return $this->encrypt($value, false);
    }
 
    public function decrypt(string $payload, $unserialize = true) {
        $payload = $this->getJsonPayload($payload);
        $iv = base64_decode($payload['iv']);
        $decrypted = \openssl_decrypt($payload['value'], $this->cipher, $this->key, 0, $iv);
 
        if ($decrypted === false) {
            throw new DecryptException('Could not decrypt the data.');
        }
 
        return $unserialize ? unserialize($decrypted) : $decrypted;
    }
 
    public function decryptString($payload) {
        return $this->decrypt($payload, false);
    }
 
    public static function isValidKey(string $key, string $cipher): bool {
        $length = \strlen($key);
        return isset(self::$acceptedCiphers[$length]) && self::$acceptedCiphers[$length] === $cipher;
    }
 
    public static function generateKey(string $cipher): string {
        $sizeMethods = \array_flip(self::$acceptedCiphers);
        return \bin2hex(\random_bytes($sizeMethods[$cipher] / 2));
    }
 
    public function getKey() {
        return $this->key;
    }
 
    public function getCipher() {
        return $this->cipher;
    }
 
    public static function getMethods(?bool $aliases = null): array {
        return \openssl_get_cipher_methods($aliases);
    }
}