[Summary view] [Print] [Text view]

   1  <?php
   2  /**
   3   * Part of the Joomla Framework Crypt Package
   4   *
   5   * @copyright  Copyright (C) 2005 - 2021 Open Source Matters, Inc. All rights reserved.
   6   * @license    GNU General Public License version 2 or later; see LICENSE
   7   */
   8  
   9  namespace Joomla\Crypt\Cipher;
  10  
  11  use Joomla\Crypt\CipherInterface;
  12  use Joomla\Crypt\Exception\DecryptionException;
  13  use Joomla\Crypt\Exception\EncryptionException;
  14  use Joomla\Crypt\Exception\InvalidKeyException;
  15  use Joomla\Crypt\Exception\InvalidKeyTypeException;
  16  use Joomla\Crypt\Exception\UnsupportedCipherException;
  17  use Joomla\Crypt\Key;
  18  use ParagonIE\Sodium\Compat;
  19  
  20  /**
  21   * Cipher for sodium algorithm encryption, decryption and key generation.
  22   *
  23   * @since  1.4.0
  24   */
  25  class Sodium implements CipherInterface
  26  {
  27      /**
  28       * The message nonce to be used with encryption/decryption
  29       *
  30       * @var    string
  31       * @since  1.4.0
  32       */
  33      private $nonce;
  34  
  35      /**
  36       * Method to decrypt a data string.
  37       *
  38       * @param   string  $data  The encrypted string to decrypt.
  39       * @param   Key     $key   The key object to use for decryption.
  40       *
  41       * @return  string  The decrypted data string.
  42       *
  43       * @since   1.4.0
  44       * @throws  DecryptionException if the data cannot be decrypted
  45       * @throws  InvalidKeyTypeException if the key is not valid for the cipher
  46       */
  47  	public function decrypt($data, Key $key)
  48      {
  49          // Validate key.
  50          if ($key->getType() !== 'sodium')
  51          {
  52              throw new InvalidKeyTypeException('sodium', $key->getType());
  53          }
  54  
  55          if (!$this->nonce)
  56          {
  57              throw new DecryptionException('Missing nonce to decrypt data');
  58          }
  59  
  60          // Use the sodium extension (PHP 7.2 native, PECL 2.x, or paragonie/sodium_compat) if able
  61          if (\function_exists('sodium_crypto_box_open'))
  62          {
  63              try
  64              {
  65                  $decrypted = sodium_crypto_box_open(
  66                      $data,
  67                      $this->nonce,
  68                      sodium_crypto_box_keypair_from_secretkey_and_publickey($key->getPrivate(), $key->getPublic())
  69                  );
  70  
  71                  if ($decrypted === false)
  72                  {
  73                      throw new DecryptionException('Malformed message or invalid MAC');
  74                  }
  75              }
  76              catch (\SodiumException $exception)
  77              {
  78                  throw new DecryptionException('Malformed message or invalid MAC', $exception->getCode(), $exception);
  79              }
  80  
  81              return $decrypted;
  82          }
  83  
  84          // Use the libsodium extension (PECL 1.x) if able; purposefully skipping sodium_compat fallback here as that will match the above check
  85          if (\extension_loaded('libsodium'))
  86          {
  87              $decrypted = \Sodium\crypto_box_open(
  88                  $data,
  89                  $this->nonce,
  90                  \Sodium\crypto_box_keypair_from_secretkey_and_publickey($key->getPrivate(), $key->getPublic())
  91              );
  92  
  93              if ($decrypted === false)
  94              {
  95                  throw new DecryptionException('Malformed message or invalid MAC');
  96              }
  97  
  98              return $decrypted;
  99          }
 100  
 101          // Well this is awkward
 102          throw new UnsupportedCipherException(static::class);
 103      }
 104  
 105      /**
 106       * Method to encrypt a data string.
 107       *
 108       * @param   string  $data  The data string to encrypt.
 109       * @param   Key     $key   The key object to use for encryption.
 110       *
 111       * @return  string  The encrypted data string.
 112       *
 113       * @since   1.4.0
 114       * @throws  EncryptionException if the data cannot be encrypted
 115       * @throws  InvalidKeyTypeException if the key is not valid for the cipher
 116       */
 117  	public function encrypt($data, Key $key)
 118      {
 119          // Validate key.
 120          if ($key->getType() !== 'sodium')
 121          {
 122              throw new InvalidKeyTypeException('sodium', $key->getType());
 123          }
 124  
 125          if (!$this->nonce)
 126          {
 127              throw new EncryptionException('Missing nonce to decrypt data');
 128          }
 129  
 130          // Use the sodium extension (PHP 7.2 native, PECL 2.x, or paragonie/sodium_compat) if able
 131          if (\function_exists('sodium_crypto_box'))
 132          {
 133              try
 134              {
 135                  return sodium_crypto_box(
 136                      $data,
 137                      $this->nonce,
 138                      sodium_crypto_box_keypair_from_secretkey_and_publickey($key->getPrivate(), $key->getPublic())
 139                  );
 140              }
 141              catch (\SodiumException $exception)
 142              {
 143                  throw new EncryptionException('Could not encrypt file.', $exception->getCode(), $exception);
 144              }
 145          }
 146  
 147          // Use the libsodium extension (PECL 1.x) if able; purposefully skipping sodium_compat fallback here as that will match the above check
 148          if (\extension_loaded('libsodium'))
 149          {
 150              return \Sodium\crypto_box(
 151                  $data,
 152                  $this->nonce,
 153                  \Sodium\crypto_box_keypair_from_secretkey_and_publickey($key->getPrivate(), $key->getPublic())
 154              );
 155          }
 156  
 157          // Well this is awkward
 158          throw new UnsupportedCipherException(static::class);
 159      }
 160  
 161      /**
 162       * Method to generate a new encryption key object.
 163       *
 164       * @param   array  $options  Key generation options.
 165       *
 166       * @return  Key
 167       *
 168       * @since   1.4.0
 169       * @throws  InvalidKeyException if the key cannot be generated
 170       * @throws  UnsupportedCipherException if the cipher is not supported on the current environment
 171       */
 172  	public function generateKey(array $options = [])
 173      {
 174          // Use the sodium extension (PHP 7.2 native, PECL 2.x, or paragonie/sodium_compat) if able
 175          if (\function_exists('sodium_crypto_box_keypair'))
 176          {
 177              try
 178              {
 179                  // Generate the encryption key.
 180                  $pair = sodium_crypto_box_keypair();
 181  
 182                  return new Key('sodium', sodium_crypto_box_secretkey($pair), sodium_crypto_box_publickey($pair));
 183              }
 184              catch (\SodiumException $exception)
 185              {
 186                  throw new InvalidKeyException('Could not generate encryption key.', $exception->getCode(), $exception);
 187              }
 188          }
 189  
 190          // Use the libsodium extension (PECL 1.x) if able; purposefully skipping sodium_compat fallback here as that will match the above check
 191          if (\extension_loaded('libsodium'))
 192          {
 193              // Generate the encryption key.
 194              $pair = \Sodium\crypto_box_keypair();
 195  
 196              return new Key('sodium', \Sodium\crypto_box_secretkey($pair), \Sodium\crypto_box_publickey($pair));
 197          }
 198  
 199          // Well this is awkward
 200          throw new UnsupportedCipherException(static::class);
 201      }
 202  
 203      /**
 204       * Check if the cipher is supported in this environment.
 205       *
 206       * @return  boolean
 207       *
 208       * @since   2.0.0
 209       */
 210  	public static function isSupported(): bool
 211      {
 212          // Prefer ext/sodium, then ext/libsodium, then presence of paragonie/sodium_compat
 213          return \function_exists('sodium_crypto_box') || \extension_loaded('libsodium') || class_exists(Compat::class);
 214      }
 215  
 216      /**
 217       * Set the nonce to use for encrypting/decrypting messages
 218       *
 219       * @param   string  $nonce  The message nonce
 220       *
 221       * @return  void
 222       *
 223       * @since   1.4.0
 224       */
 225  	public function setNonce($nonce)
 226      {
 227          $this->nonce = $nonce;
 228      }
 229  }