CryptClass/CryptClass.php at master · Esysteme/CryptClass · GitHub

History

401 lines (334 loc) · 14.3 KB

Raw

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

273

274

275

276

277

278

279

280

281

282

283

284

285

286

287

288

289

290

291

292

293

294

295

296

297

298

299

300

301

302

303

304

305

306

307

308

309

310

311

312

313

314

315

316

317

318

319

320

321

322

323

324

325

326

327

328

329

330

331

332

333

334

335

336

337

338

339

340

341

342

343

344

345

346

347

348

349

350

351

352

353

354

355

356

357

358

359

360

361

362

363

364

365

366

367

368

369

370

371

372

373

374

375

376

377

378

379

380

381

382

383

384

385

386

387

388

389

390

391

392

393

394

395

396

397

398

399

400

<?php

/****************************************************************************

* Crypt / CryptAesClass / CryptClass

* Nicholas de Jong - http://nicholasdejong.com - https://github.com/ndejong

* 27 November 2011

* @author Nicholas de Jong

* @copyright Nicholas de Jong

****************************************************************************/

/**

* Crypt - a static interface to CryptAesClass

class Crypt {

/**

* Default CryptAesClass settings

static public $compress = true; // compress the data before encrypting

static public $base64_encode = true; // base64_encode the encrypted data

static public $url_safe = true; // make the encrypted data url_safe

static public $use_keygen = true; // transform a user supplied key into a key using more of the available keyspace

static public $keygen_length = 32; // where 32 = AES256, 24 = AES192, 16 = AES128

static public $test_decrypt_before_return = false;

/**

* The key to use if encrypt/decrypt is called without the second $key argument

static public $key = null;

/**

* $CryptAesClass

* @var Class

static private $CryptAesClass = null;

/**

* encrypt

* @param mixed $data

* @param string $key

* @return string

static public function encrypt($data,$key=null) {

self::__init($key);

return self::$CryptAesClass->encrypt($data,$key);

}

/**

* decrypt

* @param string $data

* @param string $key

* @return mixed

static public function decrypt($data,$key=null) {

self::__init($key);

return self::$CryptAesClass->decrypt($data,$key);

}

/**

* keygen

* @param string $data

* @return string

static public function keygen($clear_text,$length=32) {

self::__init(null);

return self::$CryptAesClass->keygen($clear_text,$length);

}

/**

* __init

* @param string $key

static private function __init($key) {

// Read the key from Crypt.key if it is empty here

if(empty($key)) {

$key = self::$key;

}

// Setup the options for CryptAesClass

$options = array(

'compress' => self::$compress,

'base64_encode' => self::$base64_encode,

'url_safe' => self::$url_safe,

'use_keygen' => self::$use_keygen,

'keygen_length' => self::$keygen_length,

'test_decrypt_before_return' => self::$test_decrypt_before_return,

);

// Create CryptAesClass if we don't have not yet

if(!self::$CryptAesClass) {

self::$CryptAesClass = new CryptAesClass($key,$options);

}

/**

* CryptAesClass

class CryptAesClass {

/**

* $options

* @var array

public $options = null;

/**

* $key

* @var string

public $key = null;

/**

* $debug

* @var bool

public $debug = true;

/**

* __construct()

* @param string $cipher

* @param string $key

* @param string $mode

* @param string $iv

function __construct($key=null,$options=array()) {

// Make sure php mcrypt is available here

if(!function_exists('mcrypt_decrypt')) {

throw new Exception("Required PHP dependency library 'mcrypt' is not available - http://php.net/manual/en/book.mcrypt.php");

}

// The options to use

$this->options = array_merge(

array(

'compress' => true, // compress the data before encrypting

'base64_encode' => true, // base64_encode the encrypted data

'url_safe' => true, // make the encrypted data url_safe

'use_keygen' => true, // transform a user supplied key into a key using more of the available keyspace

'keygen_length' => 32, // where 32 = AES256, 24 = AES192, 16 = AES128

'test_decrypt_before_return' => false,

(array)$options

);

// Catch the key if it is supplied at this point

if(!empty($key)) {

$this->key = $key;

}

/**

* encrypt()

* @param mixed $data_in

* @param string $key

* @return string

public function encrypt($data_in,$key=null) {

// Return early if $data is empty

if (empty($data_in)) {

return $data_in;

}

// Make sure we have a key value

if(empty($key)) {

$key = $this->key;

}

// serialize the source data - we use serialize over json_encode

// because serialize is binary safe and JSON is not

$data = serialize($data_in);

// Compress if required

if ($this->options['compress']) {

$data = gzcompress($data);

}

// Encrypt the data

$data = $this->_encryptData($data,$key);

// Base64 encode if required

if ($this->options['base64_encode']) {

$data = base64_encode($data);

// URL safe if required - note that we only do url_safe

// if the data has been guarded by a base64_encode first

if ($this->options['url_safe']) {

$data = strtr($data, '+/=', '-_,');

}

// Decrypt test if we need to

if ($this->options['test_decrypt_before_return']) {

if ($data_in !== $this->decrypt($data,$key)) {

throw new Exception('Unable to confirm encrypted data will match decrypted data!');

}

return $data;

}

/**

* decrypt()

* @param string $data

* @param string $key

* @return mixed

public function decrypt($data_in,$key=null) {

// Return early if $data is empty

if (empty($data_in)) {

return $data_in;

}

// Make sure we have a key value

if(empty($key)) {

$key = $this->key;

}

$data = $data_in;

// URL safe if required only if base64_encode performed

if ($this->options['url_safe'] && $this->options['base64_encode']) {

$data = strtr($data, '-_,', '+/=');

}

// Base64 encode if required

if ($this->options['base64_encode']) {

$data = base64_decode($data);

}

// Decrypt the data

$data = $this->_decryptData($data,$key);

// Decompress if required

if ($this->options['compress']) {

$data = gzuncompress($data);

}

// Unserialize the data

return unserialize($data);

}

/**

* keygen()

* generates the same return value for any given input value

* @param string $clear_text

public function keygen($clear_text,$length=null) {

// Set the length of the key we will generate here

if(empty($length)) {

$length = $this->options['keygen_length'];

}

// The hard coded first character to pick from the $string below

// we do this because the first set of characters in a base64_encode

// comes from a limited range of characters which is what we want

// avoid in the first place

$first_character_position = 20;

// The generated string based on the known $clear_text - to get

// a good jumble of (printable) characters we use the expression

// below which will always return the same output string for the

// same input clear_text

$string = base64_encode(base64_encode(md5($clear_text,true).md5($clear_text,true)));

// The key to return based on the first position and the required length

return substr($string,$first_character_position,$length);

}

/**

* _decryptData

* @param string $data_with_iv_suffix

* @param string $key

* @param string $delimiter

* @return string

protected function _decryptData($data_with_iv_suffix,$key) {

// Transform the user key into something that uses a wider spectrum of the possible keyspace

if($this->options['use_keygen']) {

$key = $this->keygen($key,$this->options['keygen_length']);

}

$this->_preChecks($key);

// encrypt the data

$data = mcrypt_decrypt(

MCRYPT_RIJNDAEL_128, // AES is RIJNDAEL with a block size of 128 bits only

$key, // secret key - NOTE: key size determines AES_128, AES_192 or AES_256

substr($data_with_iv_suffix,0,(strlen($data_with_iv_suffix)-16)), // the data with the last 128 bytes (16 chars) removed since that part is the iv

MCRYPT_MODE_CBC, // cipher mode

substr($data_with_iv_suffix,(strlen($data_with_iv_suffix)-16),16) // the iv

);

// Don't strip null padding if compression was used else the

// decompress process will fail later on

if($this->options['compress']) {

return $data;

}

return rtrim($data,"\0");

}

/**

* _encryptData

* @param string $data

* @param string $key

* @param string $delimiter

* @return string

protected function _encryptData($data,$key) {

// Transform the user key into something that uses a wider spectrum of the possible keyspace

if($this->options['use_keygen']) {

$key = $this->keygen($key,$this->options['keygen_length']);

}

$this->_preChecks($key);

// Choose a good random iv -> 16chars * 8bits = 128 block size for MCRYPT_RIJNDAEL_128

$iv = $this->keygen(md5(mt_rand(0,1000000000)).md5(mt_rand(0,1000000000)),16);

// encrypt the data

$data = mcrypt_encrypt(

MCRYPT_RIJNDAEL_128, // AES is RIJNDAEL with a block size of 128 bits only

$key, // secret key - NOTE: key size determines AES_128, AES_192 or AES_256

$data, // data to encrypt

MCRYPT_MODE_CBC, // cipher mode

$iv // the random iv

);

// Append the iv at the end, the return data is useless without knowing it

return $data.$iv;

}

/**

* _preChecks

* @param type $key

protected function _preChecks($key) {

// Make sure there is a key value set

if(empty($key)) {

throw new Exception('No $key value supplied for crypt operation');

}

// Make sure the key length is valid for AES - it is the key length

// determines which strength AES is used, ie AES_128, AES_192 or AES_256

$key_length = (strlen($key)*8);

if('128' != $key_length && '192' != $key_length && '256' != $key_length) {

throw new Exception('Unsuitable key length for AES type encryption - the key value *MUST* be 128, 192 or 256 bits which means it must be 16, 24 or 32 string characters in length');

}

return true;

}

/**

* CryptClass - a quick drop-in replacement for the old CryptClass that had a

* silly problem by using a static IV value

* http://www.nicholasdejong.com/story/robust-crypt-functionality-use-cakephp-and-other-frameworks

class CryptClass {

private $CryptAesClass = null;

public function __construct($cipher,$key,$mode,$iv) {

$this->CryptAesClass = new CryptAesClass($key);

}

public function encrypt($data) {

return $this->CryptAesClass->encrypt($data);

}

public function decrypt($data) {

return $this->CryptAesClass->decrypt($data);

}

CryptClass/CryptClass.php at master · Esysteme/CryptClass · GitHub

Expand file tree

Breadcrumbs

CryptClass.php

Latest commit

History

Breadcrumbs

CryptClass.php

File metadata and controls