[Summary view] [Print] [Text view]

   1  <?php
   2  
   3  if (!defined('SODIUM_COMPAT_AEGIS_C0')) {
   4      define('SODIUM_COMPAT_AEGIS_C0', "\x00\x01\x01\x02\x03\x05\x08\x0d\x15\x22\x37\x59\x90\xe9\x79\x62");
   5  }
   6  if (!defined('SODIUM_COMPAT_AEGIS_C1')) {
   7      define('SODIUM_COMPAT_AEGIS_C1', "\xdb\x3d\x18\x55\x6d\xc2\x2f\xf1\x20\x11\x31\x42\x73\xb5\x28\xdd");
   8  }
   9  
  10  class ParagonIE_Sodium_Core_AEGIS256 extends ParagonIE_Sodium_Core_AES
  11  {
  12      /**
  13       * @param string $ct
  14       * @param string $tag
  15       * @param string $ad
  16       * @param string $key
  17       * @param string $nonce
  18       * @return string
  19       * @throws SodiumException
  20       */
  21      public static function decrypt($ct, $tag, $ad, $key, $nonce)
  22      {
  23          $state = self::init($key, $nonce);
  24  
  25          // ad_blocks = Split(ZeroPad(ad, 128), 128)
  26          $ad_blocks = (self::strlen($ad) + 15) >> 4;
  27          // for ai in ad_blocks:
  28          //     Absorb(ai)
  29          for ($i = 0; $i < $ad_blocks; ++$i) {
  30              $ai = self::substr($ad, $i << 4, 16);
  31              if (self::strlen($ai) < 16) {
  32                  $ai = str_pad($ai, 16, "\0", STR_PAD_RIGHT);
  33              }
  34              $state->absorb($ai);
  35          }
  36  
  37          $msg = '';
  38          $cn = self::strlen($ct) & 15;
  39          $ct_blocks = self::strlen($ct) >> 4;
  40          // ct_blocks = Split(ZeroPad(ct, 128), 128)
  41          // cn = Tail(ct, |ct| mod 128)
  42          for ($i = 0; $i < $ct_blocks; ++$i) {
  43              $msg .= $state->dec(self::substr($ct, $i << 4, 16));
  44          }
  45          // if cn is not empty:
  46          //   msg = msg || DecPartial(cn)
  47          if ($cn) {
  48              $start = $ct_blocks << 4;
  49              $msg .= $state->decPartial(self::substr($ct, $start, $cn));
  50          }
  51          $expected_tag = $state->finalize(
  52              self::strlen($ad) << 3,
  53              self::strlen($msg) << 3
  54          );
  55          if (!self::hashEquals($expected_tag, $tag)) {
  56              try {
  57                  // The RFC says to erase msg, so we shall try:
  58                  ParagonIE_Sodium_Compat::memzero($msg);
  59              } catch (SodiumException $ex) {
  60                  // Do nothing if we cannot memzero
  61              }
  62              throw new SodiumException('verification failed');
  63          }
  64          return $msg;
  65      }
  66  
  67      /**
  68       * @param string $msg
  69       * @param string $ad
  70       * @param string $key
  71       * @param string $nonce
  72       * @return array
  73       * @throws SodiumException
  74       */
  75      public static function encrypt($msg, $ad, $key, $nonce)
  76      {
  77          $state = self::init($key, $nonce);
  78          $ad_len = self::strlen($ad);
  79          $msg_len = self::strlen($msg);
  80          $ad_blocks = ($ad_len + 15) >> 4;
  81          for ($i = 0; $i < $ad_blocks; ++$i) {
  82              $ai = self::substr($ad, $i << 4, 16);
  83              if (self::strlen($ai) < 16) {
  84                  $ai = str_pad($ai, 16, "\0", STR_PAD_RIGHT);
  85              }
  86              $state->absorb($ai);
  87          }
  88  
  89          $ct = '';
  90          $msg_blocks = ($msg_len + 15) >> 4;
  91          for ($i = 0; $i < $msg_blocks; ++$i) {
  92              $xi = self::substr($msg, $i << 4, 16);
  93              if (self::strlen($xi) < 16) {
  94                  $xi = str_pad($xi, 16, "\0", STR_PAD_RIGHT);
  95              }
  96              $ct .= $state->enc($xi);
  97          }
  98          $tag = $state->finalize(
  99              $ad_len << 3,
 100              $msg_len << 3
 101          );
 102          return array(
 103              self::substr($ct, 0, $msg_len),
 104              $tag
 105          );
 106  
 107      }
 108  
 109      /**
 110       * @param string $key
 111       * @param string $nonce
 112       * @return ParagonIE_Sodium_Core_AEGIS_State256
 113       */
 114      public static function init($key, $nonce)
 115      {
 116          return ParagonIE_Sodium_Core_AEGIS_State256::init($key, $nonce);
 117      }
 118  }