OATHAuthUtils.php

Go to the documentation of this file.

<?php
class OATHAuthUtils {
    public static function isEnabledFor( User $user ) {
        $oathUser = OATHAuthHooks::getOATHUserRepository()->findByUser( $user );
        return $oathUser && $oathUser->getKey();
    }
 
    public static function encryptSessionData( array $plaintextVars, $userId ) {
        $keyMaterial = self::getKeyMaterials();
        $keys = self::getUserKeys( $keyMaterial, $userId );
        return self::seal( json_encode( $plaintextVars ), $keys['encrypt'], $keys['hmac'] );
    }
 
    public static function decryptSessionData( $ciphertext, $userId ) {
        $keyMaterial = self::getKeyMaterials();
        $keys = self::getUserKeys( $keyMaterial, $userId );
        return json_decode( self::unseal( $ciphertext, $keys['encrypt'], $keys['hmac'] ), true );
    }
 
    private static function getKeyMaterials() {
        global $wgOATHAuthSecret, $wgSecretKey;
        return $wgOATHAuthSecret ?: $wgSecretKey;
    }
 
    private static function getUserKeys( $secret, $userid ) {
        $keymats = hash_pbkdf2( 'sha256', $secret, "oath-$userid", 10001, 64, true );
        return [
            'encrypt' => substr( $keymats, 0, 32 ),
            'hmac' => substr( $keymats, 32, 32 ),
        ];
    }
 
    private static function seal( $data, $encKey, $hmacKey ) {
        $iv = random_bytes( 16 );
        $ciphertext = openssl_encrypt(
            $data,
            'aes-256-ctr',
            $encKey,
            OPENSSL_RAW_DATA,
            $iv
        );
        $sealed = base64_encode( $iv ) . '.' . base64_encode( $ciphertext );
        $hmac = hash_hmac( 'sha256', $sealed, $hmacKey, true );
        return base64_encode( $hmac ) . '.' . $sealed;
    }
 
    private static function unseal( $encrypted, $encKey, $hmacKey ) {
        $pieces = explode( '.', $encrypted );
        if ( count( $pieces ) !== 3 ) {
            throw new InvalidArgumentException( 'Invalid sealed-secret format' );
        }
 
        list( $hmac, $iv, $ciphertext ) = $pieces;
        $integCalc = hash_hmac( 'sha256', $iv . '.' . $ciphertext, $hmacKey, true );
        if ( !hash_equals( $integCalc, base64_decode( $hmac ) ) ) {
            throw new Exception( 'Sealed secret has been tampered with, aborting.' );
        }
 
        return openssl_decrypt(
            base64_decode( $ciphertext ),
            'aes-256-ctr',
            $encKey,
            OPENSSL_RAW_DATA,
            base64_decode( $iv )
        );
    }
 
}