File manager

File manager - Edit - /home/opticamezl/www/newok/defuse.zip

Back
PK��r�\c��$��php-encryption/src/KeyOrPassword.phpnu��[��<?php namespace Defuse\Crypto; use Defuse\Crypto\Exception as Ex; final class KeyOrPassword { const PBKDF2_ITERATIONS = 100000; const SECRET_TYPE_KEY = 1; const SECRET_TYPE_PASSWORD = 2; /** * @var int / private $secret_type = 0; /* * @var Key\|string / private $secret; /* * Initializes an instance of KeyOrPassword from a key. * * @param Key $key * * @return KeyOrPassword / public static function createFromKey(Key $key) { return new KeyOrPassword(self::SECRET_TYPE_KEY, $key); } /* * Initializes an instance of KeyOrPassword from a password. * * @param string $password * * @return KeyOrPassword / public static function createFromPassword( #[\SensitiveParameter] $password ) { return new KeyOrPassword(self::SECRET_TYPE_PASSWORD, $password); } /* * Derives authentication and encryption keys from the secret, using a slow * key derivation function if the secret is a password. * * @param string $salt * * @throws Ex\CryptoException * @throws Ex\EnvironmentIsBrokenException * * @return DerivedKeys / public function deriveKeys($salt) { Core::ensureTrue( Core::ourStrlen($salt) === Core::SALT_BYTE_SIZE, 'Bad salt.' ); if ($this->secret_type === self::SECRET_TYPE_KEY) { Core::ensureTrue($this->secret instanceof Key); /* * @psalm-suppress PossiblyInvalidMethodCall / $akey = Core::HKDF( Core::HASH_FUNCTION_NAME, $this->secret->getRawBytes(), Core::KEY_BYTE_SIZE, Core::AUTHENTICATION_INFO_STRING, $salt ); /* * @psalm-suppress PossiblyInvalidMethodCall / $ekey = Core::HKDF( Core::HASH_FUNCTION_NAME, $this->secret->getRawBytes(), Core::KEY_BYTE_SIZE, Core::ENCRYPTION_INFO_STRING, $salt ); return new DerivedKeys($akey, $ekey); } elseif ($this->secret_type === self::SECRET_TYPE_PASSWORD) { Core::ensureTrue(\is_string($this->secret)); / Our PBKDF2 polyfill is vulnerable to a DoS attack documented in * GitHub issue #230. The fix is to pre-hash the password to ensure * it is short. We do the prehashing here instead of in pbkdf2() so * that pbkdf2() still computes the function as defined by the * standard. / /* * @psalm-suppress PossiblyInvalidArgument / $prehash = \hash(Core::HASH_FUNCTION_NAME, $this->secret, true); $prekey = Core::pbkdf2( Core::HASH_FUNCTION_NAME, $prehash, $salt, self::PBKDF2_ITERATIONS, Core::KEY_BYTE_SIZE, true ); $akey = Core::HKDF( Core::HASH_FUNCTION_NAME, $prekey, Core::KEY_BYTE_SIZE, Core::AUTHENTICATION_INFO_STRING, $salt ); / Note the cryptographic re-use of $salt here. / $ekey = Core::HKDF( Core::HASH_FUNCTION_NAME, $prekey, Core::KEY_BYTE_SIZE, Core::ENCRYPTION_INFO_STRING, $salt ); return new DerivedKeys($akey, $ekey); } else { throw new Ex\EnvironmentIsBrokenException('Bad secret type.'); } } /* * Constructor for KeyOrPassword. * * @param int $secret_type * @param mixed $secret (either a Key or a password string) / private function __construct( $secret_type, #[\SensitiveParameter] $secret ) { // The constructor is private, so these should never throw. if ($secret_type === self::SECRET_TYPE_KEY) { Core::ensureTrue($secret instanceof Key); } elseif ($secret_type === self::SECRET_TYPE_PASSWORD) { Core::ensureTrue(\is_string($secret)); } else { throw new Ex\EnvironmentIsBrokenException('Bad secret type.'); } $this->secret_type = $secret_type; $this->secret = $secret; } } PK��r�\��s��s��-��php-encryption/src/KeyProtectedByPassword.phpnu��[��<?php namespace Defuse\Crypto; use Defuse\Crypto\Exception as Ex; final class KeyProtectedByPassword { const PASSWORD_KEY_CURRENT_VERSION = "\xDE\xF1\x00\x00"; /* * @var string / private $encrypted_key = ''; /* * Creates a random key protected by the provided password. * * @param string $password * * @throws Ex\EnvironmentIsBrokenException * * @return KeyProtectedByPassword / public static function createRandomPasswordProtectedKey( #[\SensitiveParameter] $password ) { $inner_key = Key::createNewRandomKey(); / The password is hashed as a form of poor-man's domain separation * between this use of encryptWithPassword() and other uses of * encryptWithPassword() that the user may also be using as part of the * same protocol. / $encrypted_key = Crypto::encryptWithPassword( $inner_key->saveToAsciiSafeString(), \hash(Core::HASH_FUNCTION_NAME, $password, true), true ); return new KeyProtectedByPassword($encrypted_key); } /* * Loads a KeyProtectedByPassword from its encoded form. * * @param string $saved_key_string * * @throws Ex\BadFormatException * * @return KeyProtectedByPassword / public static function loadFromAsciiSafeString( #[\SensitiveParameter] $saved_key_string ) { $encrypted_key = Encoding::loadBytesFromChecksummedAsciiSafeString( self::PASSWORD_KEY_CURRENT_VERSION, $saved_key_string ); return new KeyProtectedByPassword($encrypted_key); } /* * Encodes the KeyProtectedByPassword into a string of printable ASCII * characters. * * @throws Ex\EnvironmentIsBrokenException * * @return string / public function saveToAsciiSafeString() { return Encoding::saveBytesToChecksummedAsciiSafeString( self::PASSWORD_KEY_CURRENT_VERSION, $this->encrypted_key ); } /* * Decrypts the protected key, returning an unprotected Key object that can * be used for encryption and decryption. * * @throws Ex\EnvironmentIsBrokenException * @throws Ex\WrongKeyOrModifiedCiphertextException * * @param string $password * @return Key / public function unlockKey( #[\SensitiveParameter] $password ) { try { $inner_key_encoded = Crypto::decryptWithPassword( $this->encrypted_key, \hash(Core::HASH_FUNCTION_NAME, $password, true), true ); return Key::loadFromAsciiSafeString($inner_key_encoded); } catch (Ex\BadFormatException $ex) { / This should never happen unless an attacker replaced the * encrypted key ciphertext with some other ciphertext that was * encrypted with the same password. We transform the exception type * here in order to make the API simpler, avoiding the need to * document that this method might throw an Ex\BadFormatException. / throw new Ex\WrongKeyOrModifiedCiphertextException( "The decrypted key was found to be in an invalid format. " . "This very likely indicates it was modified by an attacker." ); } } /* * Changes the password. * * @param string $current_password * @param string $new_password * * @throws Ex\EnvironmentIsBrokenException * @throws Ex\WrongKeyOrModifiedCiphertextException * * @return KeyProtectedByPassword / public function changePassword( #[\SensitiveParameter] $current_password, #[\SensitiveParameter] $new_password ) { $inner_key = $this->unlockKey($current_password); / The password is hashed as a form of poor-man's domain separation * between this use of encryptWithPassword() and other uses of * encryptWithPassword() that the user may also be using as part of the * same protocol. / $encrypted_key = Crypto::encryptWithPassword( $inner_key->saveToAsciiSafeString(), \hash(Core::HASH_FUNCTION_NAME, $new_password, true), true ); $this->encrypted_key = $encrypted_key; return $this; } /* * Constructor for KeyProtectedByPassword. * * @param string $encrypted_key / private function __construct($encrypted_key) { $this->encrypted_key = $encrypted_key; } } PK��r�\Oܯh=��h=��php-encryption/src/Core.phpnu��[��<?php namespace Defuse\Crypto; use Defuse\Crypto\Exception as Ex; final class Core { const HEADER_VERSION_SIZE = 4; const MINIMUM_CIPHERTEXT_SIZE = 84; const CURRENT_VERSION = "\xDE\xF5\x02\x00"; const CIPHER_METHOD = 'aes-256-ctr'; const BLOCK_BYTE_SIZE = 16; const KEY_BYTE_SIZE = 32; const SALT_BYTE_SIZE = 32; const MAC_BYTE_SIZE = 32; const HASH_FUNCTION_NAME = 'sha256'; const ENCRYPTION_INFO_STRING = 'DefusePHP\|V2\|KeyForEncryption'; const AUTHENTICATION_INFO_STRING = 'DefusePHP\|V2\|KeyForAuthentication'; const BUFFER_BYTE_SIZE = 1048576; const LEGACY_CIPHER_METHOD = 'aes-128-cbc'; const LEGACY_BLOCK_BYTE_SIZE = 16; const LEGACY_KEY_BYTE_SIZE = 16; const LEGACY_HASH_FUNCTION_NAME = 'sha256'; const LEGACY_MAC_BYTE_SIZE = 32; const LEGACY_ENCRYPTION_INFO_STRING = 'DefusePHP\|KeyForEncryption'; const LEGACY_AUTHENTICATION_INFO_STRING = 'DefusePHP\|KeyForAuthentication'; / * V2.0 Format: VERSION (4 bytes) \|\| SALT (32 bytes) \|\| IV (16 bytes) \|\| * CIPHERTEXT (varies) \|\| HMAC (32 bytes) * * V1.0 Format: HMAC (32 bytes) \|\| IV (16 bytes) \|\| CIPHERTEXT (varies). / /* * Adds an integer to a block-sized counter. * * @param string $ctr * @param int $inc * * @throws Ex\EnvironmentIsBrokenException * * @return string * * @psalm-suppress RedundantCondition - It's valid to use is_int to check for overflow. / public static function incrementCounter($ctr, $inc) { Core::ensureTrue( Core::ourStrlen($ctr) === Core::BLOCK_BYTE_SIZE, 'Trying to increment a nonce of the wrong size.' ); Core::ensureTrue( \is_int($inc), 'Trying to increment nonce by a non-integer.' ); // The caller is probably re-using CTR-mode keystream if they increment by 0. Core::ensureTrue( $inc > 0, 'Trying to increment a nonce by a nonpositive amount' ); Core::ensureTrue( $inc <= PHP_INT_MAX - 255, 'Integer overflow may occur' ); / * We start at the rightmost byte (big-endian) * So, too, does OpenSSL: http://stackoverflow.com/a/3146214/2224584 / for ($i = Core::BLOCK_BYTE_SIZE - 1; $i >= 0; --$i) { $sum = \ord($ctr[$i]) + $inc; / Detect integer overflow and fail. / Core::ensureTrue(\is_int($sum), 'Integer overflow in CTR mode nonce increment'); $ctr[$i] = \pack('C', $sum & 0xFF); $inc = $sum >> 8; } return $ctr; } /* * Returns a random byte string of the specified length. * * @param int $octets * * @throws Ex\EnvironmentIsBrokenException * * @return string / public static function secureRandom($octets) { if ($octets <= 0) { throw new Ex\CryptoException( 'A zero or negative amount of random bytes was requested.' ); } self::ensureFunctionExists('random_bytes'); try { return \random_bytes(max(1, $octets)); } catch (\Exception $ex) { throw new Ex\EnvironmentIsBrokenException( 'Your system does not have a secure random number generator.' ); } } /* * Computes the HKDF key derivation function specified in * http://tools.ietf.org/html/rfc5869. * * @param string $hash Hash Function * @param string $ikm Initial Keying Material * @param int $length How many bytes? * @param string $info What sort of key are we deriving? * @param string $salt * * @throws Ex\EnvironmentIsBrokenException * @psalm-suppress UndefinedFunction - We're checking if the function exists first. * * @return string / public static function HKDF($hash, $ikm, $length, $info = '', $salt = null) { static $nativeHKDF = null; if ($nativeHKDF === null) { $nativeHKDF = \is_callable('\\hash_hkdf'); } if ($nativeHKDF) { if (\is_null($salt)) { $salt = ''; } return \hash_hkdf($hash, $ikm, $length, $info, $salt); } $digest_length = Core::ourStrlen(\hash_hmac($hash, '', '', true)); // Sanity-check the desired output length. Core::ensureTrue( !empty($length) && \is_int($length) && $length >= 0 && $length <= 255 $digest_length, 'Bad output length requested of HDKF.' ); // "if [salt] not provided, is set to a string of HashLen zeroes." if (\is_null($salt)) { $salt = \str_repeat("\x00", $digest_length); } // HKDF-Extract: // PRK = HMAC-Hash(salt, IKM) // The salt is the HMAC key. $prk = \hash_hmac($hash, $ikm, $salt, true); // HKDF-Expand: // This check is useless, but it serves as a reminder to the spec. Core::ensureTrue(Core::ourStrlen($prk) >= $digest_length); // T(0) = '' $t = ''; $last_block = ''; for ($block_index = 1; Core::ourStrlen($t) < $length; ++$block_index) { // T(i) = HMAC-Hash(PRK, T(i-1) \| info \| 0x??) $last_block = \hash_hmac( $hash, $last_block . $info . \chr($block_index), $prk, true ); // T = T(1) \| T(2) \| T(3) \| ... \| T(N) $t .= $last_block; } // ORM = first L octets of T /** @var string $orm / $orm = Core::ourSubstr($t, 0, $length); Core::ensureTrue(\is_string($orm)); return $orm; } /* * Checks if two equal-length strings are the same without leaking * information through side channels. * * @param string $expected * @param string $given * * @throws Ex\EnvironmentIsBrokenException * * @return bool / public static function hashEquals($expected, $given) { static $native = null; if ($native === null) { $native = \function_exists('hash_equals'); } if ($native) { return \hash_equals($expected, $given); } // We can't just compare the strings with '==', since it would make // timing attacks possible. We could use the XOR-OR constant-time // comparison algorithm, but that may not be a reliable defense in an // interpreted language. So we use the approach of HMACing both strings // with a random key and comparing the HMACs. // We're not attempting to make variable-length string comparison // secure, as that's very difficult. Make sure the strings are the same // length. Core::ensureTrue(Core::ourStrlen($expected) === Core::ourStrlen($given)); $blind = Core::secureRandom(32); $message_compare = \hash_hmac(Core::HASH_FUNCTION_NAME, $given, $blind); $correct_compare = \hash_hmac(Core::HASH_FUNCTION_NAME, $expected, $blind); return $correct_compare === $message_compare; } /* * Throws an exception if the constant doesn't exist. * * @param string $name * @return void * * @throws Ex\EnvironmentIsBrokenException / public static function ensureConstantExists($name) { Core::ensureTrue( \defined($name), 'Constant '.$name.' does not exists' ); } /* * Throws an exception if the function doesn't exist. * * @param string $name * @return void * * @throws Ex\EnvironmentIsBrokenException / public static function ensureFunctionExists($name) { Core::ensureTrue( \function_exists($name), 'function '.$name.' does not exists' ); } /* * Throws an exception if the condition is false. * * @param bool $condition * @param string $message * @return void * * @throws Ex\EnvironmentIsBrokenException / public static function ensureTrue($condition, $message = '') { if (!$condition) { throw new Ex\EnvironmentIsBrokenException($message); } } / * We need these strlen() and substr() functions because when * 'mbstring.func_overload' is set in php.ini, the standard strlen() and * substr() are replaced by mb_strlen() and mb_substr(). / /* * Computes the length of a string in bytes. * * @param string $str * * @throws Ex\EnvironmentIsBrokenException * * @return int / public static function ourStrlen($str) { static $exists = null; if ($exists === null) { $exists = \extension_loaded('mbstring') && \function_exists('mb_strlen'); } if ($exists) { $length = \mb_strlen($str, '8bit'); Core::ensureTrue($length !== false); return $length; } else { return \strlen($str); } } /* * Behaves roughly like the function substr() in PHP 7 does. * * @param string $str * @param int $start * @param int $length * * @throws Ex\EnvironmentIsBrokenException * * @return string\|bool / public static function ourSubstr($str, $start, $length = null) { static $exists = null; if ($exists === null) { $exists = \extension_loaded('mbstring') && \function_exists('mb_substr'); } // This is required to make mb_substr behavior identical to substr. // Without this, mb_substr() would return false, contra to what the // PHP documentation says (it doesn't say it can return false.) $input_len = Core::ourStrlen($str); if ($start === $input_len && !$length) { return ''; } if ($start > $input_len) { return false; } // mb_substr($str, 0, NULL, '8bit') returns an empty string on PHP 5.3, // so we have to find the length ourselves. Also, substr() doesn't // accept null for the length. if (! isset($length)) { if ($start >= 0) { $length = $input_len - $start; } else { $length = -$start; } } if ($length < 0) { throw new \InvalidArgumentException( "Negative lengths are not supported with ourSubstr." ); } if ($exists) { $substr = \mb_substr($str, $start, $length, '8bit'); // At this point there are two cases where mb_substr can // legitimately return an empty string. Either $length is 0, or // $start is equal to the length of the string (both mb_substr and // substr return an empty string when this happens). It should never // ever return a string that's longer than $length. if (Core::ourStrlen($substr) > $length \|\| (Core::ourStrlen($substr) === 0 && $length !== 0 && $start !== $input_len)) { throw new Ex\EnvironmentIsBrokenException( 'Your version of PHP has bug #66797. Its implementation of mb_substr() is incorrect. See the details here: https://bugs.php.net/bug.php?id=66797' ); } return $substr; } return \substr($str, $start, $length); } /* * Computes the PBKDF2 password-based key derivation function. * * The PBKDF2 function is defined in RFC 2898. Test vectors can be found in * RFC 6070. This implementation of PBKDF2 was originally created by Taylor * Hornby, with improvements from http://www.variations-of-shadow.com/. * * @param string $algorithm The hash algorithm to use. Recommended: SHA256 * @param string $password The password. * @param string $salt A salt that is unique to the password. * @param int $count Iteration count. Higher is better, but slower. Recommended: At least 1000. * @param int $key_length The length of the derived key in bytes. * @param bool $raw_output If true, the key is returned in raw binary format. Hex encoded otherwise. * * @throws Ex\EnvironmentIsBrokenException * * @return string A $key_length-byte key derived from the password and salt. / public static function pbkdf2( $algorithm, #[\SensitiveParameter] $password, $salt, $count, $key_length, $raw_output = false ) { // Type checks: if (! \is_string($algorithm)) { throw new \InvalidArgumentException( 'pbkdf2(): algorithm must be a string' ); } if (! \is_string($password)) { throw new \InvalidArgumentException( 'pbkdf2(): password must be a string' ); } if (! \is_string($salt)) { throw new \InvalidArgumentException( 'pbkdf2(): salt must be a string' ); } // Coerce strings to integers with no information loss or overflow $count += 0; $key_length += 0; $algorithm = \strtolower($algorithm); Core::ensureTrue( \in_array($algorithm, \hash_algos(), true), 'Invalid or unsupported hash algorithm.' ); // Whitelist, or we could end up with people using CRC32. $ok_algorithms = [ 'sha1', 'sha224', 'sha256', 'sha384', 'sha512', 'ripemd160', 'ripemd256', 'ripemd320', 'whirlpool', ]; Core::ensureTrue( \in_array($algorithm, $ok_algorithms, true), 'Algorithm is not a secure cryptographic hash function.' ); Core::ensureTrue($count > 0 && $key_length > 0, 'Invalid PBKDF2 parameters.'); if (\function_exists('hash_pbkdf2')) { // The output length is in NIBBLES (4-bits) if $raw_output is false! if (! $raw_output) { $key_length = $key_length 2; } return \hash_pbkdf2($algorithm, $password, $salt, $count, $key_length, $raw_output); } $hash_length = Core::ourStrlen(\hash($algorithm, '', true)); $block_count = \ceil($key_length / $hash_length); $output = ''; for ($i = 1; $i <= $block_count; $i++) { // $i encoded as 4 bytes, big endian. $last = $salt . \pack('N', $i); // first iteration $last = $xorsum = \hash_hmac($algorithm, $last, $password, true); // perform the other $count - 1 iterations for ($j = 1; $j < $count; $j++) { /** * @psalm-suppress InvalidOperand / $xorsum ^= ($last = \hash_hmac($algorithm, $last, $password, true)); } $output .= $xorsum; } if ($raw_output) { return (string) Core::ourSubstr($output, 0, $key_length); } else { return Encoding::binToHex((string) Core::ourSubstr($output, 0, $key_length)); } } } PK��r�\Kt(� 9�� 9��php-encryption/src/Crypto.phpnu��[��<?php namespace Defuse\Crypto; use Defuse\Crypto\Exception as Ex; class Crypto { /* * Encrypts a string with a Key. * * @param string $plaintext * @param Key $key * @param bool $raw_binary * * @throws Ex\EnvironmentIsBrokenException * @throws \TypeError * * @return string / public static function encrypt($plaintext, $key, $raw_binary = false) { if (!\is_string($plaintext)) { throw new \TypeError( 'String expected for argument 1. ' . \ucfirst(\gettype($plaintext)) . ' given instead.' ); } if (!($key instanceof Key)) { throw new \TypeError( 'Key expected for argument 2. ' . \ucfirst(\gettype($key)) . ' given instead.' ); } if (!\is_bool($raw_binary)) { throw new \TypeError( 'Boolean expected for argument 3. ' . \ucfirst(\gettype($raw_binary)) . ' given instead.' ); } return self::encryptInternal( $plaintext, KeyOrPassword::createFromKey($key), $raw_binary ); } /* * Encrypts a string with a password, using a slow key derivation function * to make password cracking more expensive. * * @param string $plaintext * @param string $password * @param bool $raw_binary * * @throws Ex\EnvironmentIsBrokenException * @throws \TypeError * * @return string / public static function encryptWithPassword( $plaintext, #[\SensitiveParameter] $password, $raw_binary = false ) { if (!\is_string($plaintext)) { throw new \TypeError( 'String expected for argument 1. ' . \ucfirst(\gettype($plaintext)) . ' given instead.' ); } if (!\is_string($password)) { throw new \TypeError( 'String expected for argument 2. ' . \ucfirst(\gettype($password)) . ' given instead.' ); } if (!\is_bool($raw_binary)) { throw new \TypeError( 'Boolean expected for argument 3. ' . \ucfirst(\gettype($raw_binary)) . ' given instead.' ); } return self::encryptInternal( $plaintext, KeyOrPassword::createFromPassword($password), $raw_binary ); } /* * Decrypts a ciphertext to a string with a Key. * * @param string $ciphertext * @param Key $key * @param bool $raw_binary * * @throws \TypeError * @throws Ex\EnvironmentIsBrokenException * @throws Ex\WrongKeyOrModifiedCiphertextException * * @return string / public static function decrypt($ciphertext, $key, $raw_binary = false) { if (!\is_string($ciphertext)) { throw new \TypeError( 'String expected for argument 1. ' . \ucfirst(\gettype($ciphertext)) . ' given instead.' ); } if (!($key instanceof Key)) { throw new \TypeError( 'Key expected for argument 2. ' . \ucfirst(\gettype($key)) . ' given instead.' ); } if (!\is_bool($raw_binary)) { throw new \TypeError( 'Boolean expected for argument 3. ' . \ucfirst(\gettype($raw_binary)) . ' given instead.' ); } return self::decryptInternal( $ciphertext, KeyOrPassword::createFromKey($key), $raw_binary ); } /* * Decrypts a ciphertext to a string with a password, using a slow key * derivation function to make password cracking more expensive. * * @param string $ciphertext * @param string $password * @param bool $raw_binary * * @throws Ex\EnvironmentIsBrokenException * @throws Ex\WrongKeyOrModifiedCiphertextException * @throws \TypeError * * @return string / public static function decryptWithPassword( $ciphertext, #[\SensitiveParameter] $password, $raw_binary = false ) { if (!\is_string($ciphertext)) { throw new \TypeError( 'String expected for argument 1. ' . \ucfirst(\gettype($ciphertext)) . ' given instead.' ); } if (!\is_string($password)) { throw new \TypeError( 'String expected for argument 2. ' . \ucfirst(\gettype($password)) . ' given instead.' ); } if (!\is_bool($raw_binary)) { throw new \TypeError( 'Boolean expected for argument 3. ' . \ucfirst(\gettype($raw_binary)) . ' given instead.' ); } return self::decryptInternal( $ciphertext, KeyOrPassword::createFromPassword($password), $raw_binary ); } /* * Decrypts a legacy ciphertext produced by version 1 of this library. * * @param string $ciphertext * @param string $key * * @throws Ex\EnvironmentIsBrokenException * @throws Ex\WrongKeyOrModifiedCiphertextException * @throws \TypeError * * @return string / public static function legacyDecrypt( $ciphertext, #[\SensitiveParameter] $key ) { if (!\is_string($ciphertext)) { throw new \TypeError( 'String expected for argument 1. ' . \ucfirst(\gettype($ciphertext)) . ' given instead.' ); } if (!\is_string($key)) { throw new \TypeError( 'String expected for argument 2. ' . \ucfirst(\gettype($key)) . ' given instead.' ); } RuntimeTests::runtimeTest(); // Extract the HMAC from the front of the ciphertext. if (Core::ourStrlen($ciphertext) <= Core::LEGACY_MAC_BYTE_SIZE) { throw new Ex\WrongKeyOrModifiedCiphertextException( 'Ciphertext is too short.' ); } /* * @var string / $hmac = Core::ourSubstr($ciphertext, 0, Core::LEGACY_MAC_BYTE_SIZE); Core::ensureTrue(\is_string($hmac)); /* * @var string / $messageCiphertext = Core::ourSubstr($ciphertext, Core::LEGACY_MAC_BYTE_SIZE); Core::ensureTrue(\is_string($messageCiphertext)); // Regenerate the same authentication sub-key. $akey = Core::HKDF( Core::LEGACY_HASH_FUNCTION_NAME, $key, Core::LEGACY_KEY_BYTE_SIZE, Core::LEGACY_AUTHENTICATION_INFO_STRING, null ); if (self::verifyHMAC($hmac, $messageCiphertext, $akey)) { // Regenerate the same encryption sub-key. $ekey = Core::HKDF( Core::LEGACY_HASH_FUNCTION_NAME, $key, Core::LEGACY_KEY_BYTE_SIZE, Core::LEGACY_ENCRYPTION_INFO_STRING, null ); // Extract the IV from the ciphertext. if (Core::ourStrlen($messageCiphertext) <= Core::LEGACY_BLOCK_BYTE_SIZE) { throw new Ex\WrongKeyOrModifiedCiphertextException( 'Ciphertext is too short.' ); } /* * @var string / $iv = Core::ourSubstr($messageCiphertext, 0, Core::LEGACY_BLOCK_BYTE_SIZE); Core::ensureTrue(\is_string($iv)); /* * @var string / $actualCiphertext = Core::ourSubstr($messageCiphertext, Core::LEGACY_BLOCK_BYTE_SIZE); Core::ensureTrue(\is_string($actualCiphertext)); // Do the decryption. $plaintext = self::plainDecrypt($actualCiphertext, $ekey, $iv, Core::LEGACY_CIPHER_METHOD); return $plaintext; } else { throw new Ex\WrongKeyOrModifiedCiphertextException( 'Integrity check failed.' ); } } /* * Encrypts a string with either a key or a password. * * @param string $plaintext * @param KeyOrPassword $secret * @param bool $raw_binary * * @return string / private static function encryptInternal($plaintext, KeyOrPassword $secret, $raw_binary) { RuntimeTests::runtimeTest(); $salt = Core::secureRandom(Core::SALT_BYTE_SIZE); $keys = $secret->deriveKeys($salt); $ekey = $keys->getEncryptionKey(); $akey = $keys->getAuthenticationKey(); $iv = Core::secureRandom(Core::BLOCK_BYTE_SIZE); $ciphertext = Core::CURRENT_VERSION . $salt . $iv . self::plainEncrypt($plaintext, $ekey, $iv); $auth = \hash_hmac(Core::HASH_FUNCTION_NAME, $ciphertext, $akey, true); $ciphertext = $ciphertext . $auth; if ($raw_binary) { return $ciphertext; } return Encoding::binToHex($ciphertext); } /* * Decrypts a ciphertext to a string with either a key or a password. * * @param string $ciphertext * @param KeyOrPassword $secret * @param bool $raw_binary * * @throws Ex\EnvironmentIsBrokenException * @throws Ex\WrongKeyOrModifiedCiphertextException * * @return string / private static function decryptInternal($ciphertext, KeyOrPassword $secret, $raw_binary) { RuntimeTests::runtimeTest(); if (! $raw_binary) { try { $ciphertext = Encoding::hexToBin($ciphertext); } catch (Ex\BadFormatException $ex) { throw new Ex\WrongKeyOrModifiedCiphertextException( 'Ciphertext has invalid hex encoding.' ); } } if (Core::ourStrlen($ciphertext) < Core::MINIMUM_CIPHERTEXT_SIZE) { throw new Ex\WrongKeyOrModifiedCiphertextException( 'Ciphertext is too short.' ); } // Get and check the version header. /* @var string $header / $header = Core::ourSubstr($ciphertext, 0, Core::HEADER_VERSION_SIZE); if ($header !== Core::CURRENT_VERSION) { throw new Ex\WrongKeyOrModifiedCiphertextException( 'Bad version header.' ); } // Get the salt. /* @var string $salt / $salt = Core::ourSubstr( $ciphertext, Core::HEADER_VERSION_SIZE, Core::SALT_BYTE_SIZE ); Core::ensureTrue(\is_string($salt)); // Get the IV. /* @var string $iv / $iv = Core::ourSubstr( $ciphertext, Core::HEADER_VERSION_SIZE + Core::SALT_BYTE_SIZE, Core::BLOCK_BYTE_SIZE ); Core::ensureTrue(\is_string($iv)); // Get the HMAC. /* @var string $hmac / $hmac = Core::ourSubstr( $ciphertext, Core::ourStrlen($ciphertext) - Core::MAC_BYTE_SIZE, Core::MAC_BYTE_SIZE ); Core::ensureTrue(\is_string($hmac)); // Get the actual encrypted ciphertext. /* @var string $encrypted / $encrypted = Core::ourSubstr( $ciphertext, Core::HEADER_VERSION_SIZE + Core::SALT_BYTE_SIZE + Core::BLOCK_BYTE_SIZE, Core::ourStrlen($ciphertext) - Core::MAC_BYTE_SIZE - Core::SALT_BYTE_SIZE - Core::BLOCK_BYTE_SIZE - Core::HEADER_VERSION_SIZE ); Core::ensureTrue(\is_string($encrypted)); // Derive the separate encryption and authentication keys from the key // or password, whichever it is. $keys = $secret->deriveKeys($salt); if (self::verifyHMAC($hmac, $header . $salt . $iv . $encrypted, $keys->getAuthenticationKey())) { $plaintext = self::plainDecrypt($encrypted, $keys->getEncryptionKey(), $iv, Core::CIPHER_METHOD); return $plaintext; } else { throw new Ex\WrongKeyOrModifiedCiphertextException( 'Integrity check failed.' ); } } /* * Raw unauthenticated encryption (insecure on its own). * * @param string $plaintext * @param string $key * @param string $iv * * @throws Ex\EnvironmentIsBrokenException * * @return string / protected static function plainEncrypt( $plaintext, #[\SensitiveParameter] $key, #[\SensitiveParameter] $iv ) { Core::ensureConstantExists('OPENSSL_RAW_DATA'); Core::ensureFunctionExists('openssl_encrypt'); /* @var string $ciphertext / $ciphertext = \openssl_encrypt( $plaintext, Core::CIPHER_METHOD, $key, OPENSSL_RAW_DATA, $iv ); Core::ensureTrue(\is_string($ciphertext), 'openssl_encrypt() failed'); return $ciphertext; } /* * Raw unauthenticated decryption (insecure on its own). * * @param string $ciphertext * @param string $key * @param string $iv * @param string $cipherMethod * * @throws Ex\EnvironmentIsBrokenException * * @return string / protected static function plainDecrypt( $ciphertext, #[\SensitiveParameter] $key, #[\SensitiveParameter] $iv, $cipherMethod ) { Core::ensureConstantExists('OPENSSL_RAW_DATA'); Core::ensureFunctionExists('openssl_decrypt'); /* @var string $plaintext / $plaintext = \openssl_decrypt( $ciphertext, $cipherMethod, $key, OPENSSL_RAW_DATA, $iv ); Core::ensureTrue(\is_string($plaintext), 'openssl_decrypt() failed.'); return $plaintext; } /* * Verifies an HMAC without leaking information through side-channels. * * @param string $expected_hmac * @param string $message * @param string $key * * @throws Ex\EnvironmentIsBrokenException * * @return bool / protected static function verifyHMAC( $expected_hmac, $message, #[\SensitiveParameter] $key ) { $message_hmac = \hash_hmac(Core::HASH_FUNCTION_NAME, $message, $key, true); return Core::hashEquals($message_hmac, $expected_hmac); } } PK��r�\O��$��$��php-encryption/src/Encoding.phpnu��[��<?php namespace Defuse\Crypto; use Defuse\Crypto\Exception as Ex; final class Encoding { const CHECKSUM_BYTE_SIZE = 32; const CHECKSUM_HASH_ALGO = 'sha256'; const SERIALIZE_HEADER_BYTES = 4; /* * Converts a byte string to a hexadecimal string without leaking * information through side channels. * * @param string $byte_string * * @throws Ex\EnvironmentIsBrokenException * * @return string / public static function binToHex($byte_string) { $hex = ''; $len = Core::ourStrlen($byte_string); for ($i = 0; $i < $len; ++$i) { $c = \ord($byte_string[$i]) & 0xf; $b = \ord($byte_string[$i]) >> 4; $hex .= \pack( 'CC', 87 + $b + ((($b - 10) >> 8) & ~38), 87 + $c + ((($c - 10) >> 8) & ~38) ); } return $hex; } /* * Converts a hexadecimal string into a byte string without leaking * information through side channels. * * @param string $hex_string * * @throws Ex\BadFormatException * @throws Ex\EnvironmentIsBrokenException * * @return string * @psalm-suppress TypeDoesNotContainType / public static function hexToBin($hex_string) { $hex_pos = 0; $bin = ''; $hex_len = Core::ourStrlen($hex_string); $state = 0; $c_acc = 0; while ($hex_pos < $hex_len) { $c = \ord($hex_string[$hex_pos]); $c_num = $c ^ 48; $c_num0 = ($c_num - 10) >> 8; $c_alpha = ($c & ~32) - 55; $c_alpha0 = (($c_alpha - 10) ^ ($c_alpha - 16)) >> 8; if (($c_num0 \| $c_alpha0) === 0) { throw new Ex\BadFormatException( 'Encoding::hexToBin() input is not a hex string.' ); } $c_val = ($c_num0 & $c_num) \| ($c_alpha & $c_alpha0); if ($state === 0) { $c_acc = $c_val 16; } else { $bin .= \pack('C', $c_acc \| $c_val); } $state ^= 1; ++$hex_pos; } return $bin; } /** * Remove trialing whitespace without table look-ups or branches. * * Calling this function may leak the length of the string as well as the * number of trailing whitespace characters through side-channels. * * @param string $string * @return string / public static function trimTrailingWhitespace($string = '') { $length = Core::ourStrlen($string); if ($length < 1) { return ''; } do { $prevLength = $length; $last = $length - 1; $chr = \ord($string[$last]); / Null Byte (0x00), a.k.a. \0 / // if ($chr === 0x00) $length -= 1; $sub = (($chr - 1) >> 8 ) & 1; $length -= $sub; $last -= $sub; / Horizontal Tab (0x09) a.k.a. \t / $chr = \ord($string[$last]); // if ($chr === 0x09) $length -= 1; $sub = (((0x08 - $chr) & ($chr - 0x0a)) >> 8) & 1; $length -= $sub; $last -= $sub; / New Line (0x0a), a.k.a. \n / $chr = \ord($string[$last]); // if ($chr === 0x0a) $length -= 1; $sub = (((0x09 - $chr) & ($chr - 0x0b)) >> 8) & 1; $length -= $sub; $last -= $sub; / Carriage Return (0x0D), a.k.a. \r / $chr = \ord($string[$last]); // if ($chr === 0x0d) $length -= 1; $sub = (((0x0c - $chr) & ($chr - 0x0e)) >> 8) & 1; $length -= $sub; $last -= $sub; / Space / $chr = \ord($string[$last]); // if ($chr === 0x20) $length -= 1; $sub = (((0x1f - $chr) & ($chr - 0x21)) >> 8) & 1; $length -= $sub; } while ($prevLength !== $length && $length > 0); return (string) Core::ourSubstr($string, 0, $length); } / * SECURITY NOTE ON APPLYING CHECKSUMS TO SECRETS: * * The checksum introduces a potential security weakness. For example, * suppose we apply a checksum to a key, and that an adversary has an * exploit against the process containing the key, such that they can * overwrite an arbitrary byte of memory and then cause the checksum to * be verified and learn the result. * * In this scenario, the adversary can extract the key one byte at * a time by overwriting it with their guess of its value and then * asking if the checksum matches. If it does, their guess was right. * This kind of attack may be more easy to implement and more reliable * than a remote code execution attack. * * This attack also applies to authenticated encryption as a whole, in * the situation where the adversary can overwrite a byte of the key * and then cause a valid ciphertext to be decrypted, and then * determine whether the MAC check passed or failed. * * By using the full SHA256 hash instead of truncating it, I'm ensuring * that both ways of going about the attack are equivalently difficult. * A shorter checksum of say 32 bits might be more useful to the * adversary as an oracle in case their writes are coarser grained. * * Because the scenario assumes a serious vulnerability, we don't try * to prevent attacks of this style. / /* * INTERNAL USE ONLY: Applies a version header, applies a checksum, and * then encodes a byte string into a range of printable ASCII characters. * * @param string $header * @param string $bytes * * @throws Ex\EnvironmentIsBrokenException * * @return string / public static function saveBytesToChecksummedAsciiSafeString( $header, #[\SensitiveParameter] $bytes ) { // Headers must be a constant length to prevent one type's header from // being a prefix of another type's header, leading to ambiguity. Core::ensureTrue( Core::ourStrlen($header) === self::SERIALIZE_HEADER_BYTES, 'Header must be ' . self::SERIALIZE_HEADER_BYTES . ' bytes.' ); return Encoding::binToHex( $header . $bytes . \hash( self::CHECKSUM_HASH_ALGO, $header . $bytes, true ) ); } /* * INTERNAL USE ONLY: Decodes, verifies the header and checksum, and returns * the encoded byte string. * * @param string $expected_header * @param string $string * * @throws Ex\EnvironmentIsBrokenException * @throws Ex\BadFormatException * * @return string / public static function loadBytesFromChecksummedAsciiSafeString( $expected_header, #[\SensitiveParameter] $string ) { // Headers must be a constant length to prevent one type's header from // being a prefix of another type's header, leading to ambiguity. Core::ensureTrue( Core::ourStrlen($expected_header) === self::SERIALIZE_HEADER_BYTES, 'Header must be 4 bytes.' ); / If you get an exception here when attempting to load from a file, first pass your key to Encoding::trimTrailingWhitespace() to remove newline characters, etc. / $bytes = Encoding::hexToBin($string); / Make sure we have enough bytes to get the version header and checksum. / if (Core::ourStrlen($bytes) < self::SERIALIZE_HEADER_BYTES + self::CHECKSUM_BYTE_SIZE) { throw new Ex\BadFormatException( 'Encoded data is shorter than expected.' ); } / Grab the version header. / $actual_header = (string) Core::ourSubstr($bytes, 0, self::SERIALIZE_HEADER_BYTES); if ($actual_header !== $expected_header) { throw new Ex\BadFormatException( 'Invalid header.' ); } / Grab the bytes that are part of the checksum. / $checked_bytes = (string) Core::ourSubstr( $bytes, 0, Core::ourStrlen($bytes) - self::CHECKSUM_BYTE_SIZE ); / Grab the included checksum. / $checksum_a = (string) Core::ourSubstr( $bytes, Core::ourStrlen($bytes) - self::CHECKSUM_BYTE_SIZE, self::CHECKSUM_BYTE_SIZE ); / Re-compute the checksum. / $checksum_b = \hash(self::CHECKSUM_HASH_ALGO, $checked_bytes, true); / Check if the checksum matches. / if (! Core::hashEquals($checksum_a, $checksum_b)) { throw new Ex\BadFormatException( "Data is corrupted, the checksum doesn't match" ); } return (string) Core::ourSubstr( $bytes, self::SERIALIZE_HEADER_BYTES, Core::ourStrlen($bytes) - self::SERIALIZE_HEADER_BYTES - self::CHECKSUM_BYTE_SIZE ); } } PK��r�\!��"��php-encryption/src/DerivedKeys.phpnu��[��<?php namespace Defuse\Crypto; /* * Class DerivedKeys * @package Defuse\Crypto / final class DerivedKeys { /* * @var string / private $akey = ''; /* * @var string / private $ekey = ''; /* * Returns the authentication key. * @return string / public function getAuthenticationKey() { return $this->akey; } /* * Returns the encryption key. * @return string / public function getEncryptionKey() { return $this->ekey; } /* * Constructor for DerivedKeys. * * @param string $akey * @param string $ekey / public function __construct($akey, $ekey) { $this->akey = $akey; $this->ekey = $ekey; } } PK��r�\� �(� �� #��php-encryption/src/RuntimeTests.phpnu��[��<?php namespace Defuse\Crypto; use Defuse\Crypto\Exception as Ex; / * We're using static class inheritance to get access to protected methods * inside Crypto. To make it easy to know where the method we're calling can be * found, within this file, prefix calls with `Crypto::` or `RuntimeTests::`, * and don't use `self::`. / class RuntimeTests extends Crypto { /* * Runs the runtime tests. * * @throws Ex\EnvironmentIsBrokenException * @return void / public static function runtimeTest() { // 0: Tests haven't been run yet. // 1: Tests have passed. // 2: Tests are running right now. // 3: Tests have failed. static $test_state = 0; if ($test_state === 1 \|\| $test_state === 2) { return; } if ($test_state === 3) { / If an intermittent problem caused a test to fail previously, we * want that to be indicated to the user with every call to this * library. This way, if the user first does something they really * don't care about, and just ignores all exceptions, they won't get * screwed when they then start to use the library for something * they do care about. / throw new Ex\EnvironmentIsBrokenException('Tests failed previously.'); } try { $test_state = 2; Core::ensureFunctionExists('openssl_get_cipher_methods'); if (\in_array(Core::CIPHER_METHOD, \openssl_get_cipher_methods()) === false) { throw new Ex\EnvironmentIsBrokenException( 'Cipher method not supported. This is normally caused by an outdated ' . 'version of OpenSSL (and/or OpenSSL compiled for FIPS compliance). ' . 'Please upgrade to a newer version of OpenSSL that supports ' . Core::CIPHER_METHOD . ' to use this library.' ); } RuntimeTests::AESTestVector(); RuntimeTests::HMACTestVector(); RuntimeTests::HKDFTestVector(); RuntimeTests::testEncryptDecrypt(); Core::ensureTrue(Core::ourStrlen(Key::createNewRandomKey()->getRawBytes()) === Core::KEY_BYTE_SIZE); Core::ensureTrue(Core::ENCRYPTION_INFO_STRING !== Core::AUTHENTICATION_INFO_STRING); } catch (Ex\EnvironmentIsBrokenException $ex) { // Do this, otherwise it will stay in the "tests are running" state. $test_state = 3; throw $ex; } // Change this to '0' make the tests always re-run (for benchmarking). $test_state = 1; } /* * High-level tests of Crypto operations. * * @throws Ex\EnvironmentIsBrokenException * @return void / private static function testEncryptDecrypt() { $key = Key::createNewRandomKey(); $data = "EnCrYpT EvErYThInG\x00\x00"; // Make sure encrypting then decrypting doesn't change the message. $ciphertext = Crypto::encrypt($data, $key, true); try { $decrypted = Crypto::decrypt($ciphertext, $key, true); } catch (Ex\WrongKeyOrModifiedCiphertextException $ex) { // It's important to catch this and change it into a // Ex\EnvironmentIsBrokenException, otherwise a test failure could trick // the user into thinking it's just an invalid ciphertext! throw new Ex\EnvironmentIsBrokenException(); } Core::ensureTrue($decrypted === $data); // Modifying the ciphertext: Appending a string. try { Crypto::decrypt($ciphertext . 'a', $key, true); throw new Ex\EnvironmentIsBrokenException(); } catch (Ex\WrongKeyOrModifiedCiphertextException $e) { / expected / } // Modifying the ciphertext: Changing an HMAC byte. $indices_to_change = [ 0, // The header. Core::HEADER_VERSION_SIZE + 1, // the salt Core::HEADER_VERSION_SIZE + Core::SALT_BYTE_SIZE + 1, // the IV Core::HEADER_VERSION_SIZE + Core::SALT_BYTE_SIZE + Core::BLOCK_BYTE_SIZE + 1, // the ciphertext ]; foreach ($indices_to_change as $index) { try { $ciphertext[$index] = \chr((\ord($ciphertext[$index]) + 1) % 256); Crypto::decrypt($ciphertext, $key, true); throw new Ex\EnvironmentIsBrokenException(); } catch (Ex\WrongKeyOrModifiedCiphertextException $e) { / expected / } } // Decrypting with the wrong key. $key = Key::createNewRandomKey(); $data = 'abcdef'; $ciphertext = Crypto::encrypt($data, $key, true); $wrong_key = Key::createNewRandomKey(); try { Crypto::decrypt($ciphertext, $wrong_key, true); throw new Ex\EnvironmentIsBrokenException(); } catch (Ex\WrongKeyOrModifiedCiphertextException $e) { / expected / } // Ciphertext too small. $key = Key::createNewRandomKey(); $ciphertext = \str_repeat('A', Core::MINIMUM_CIPHERTEXT_SIZE - 1); try { Crypto::decrypt($ciphertext, $key, true); throw new Ex\EnvironmentIsBrokenException(); } catch (Ex\WrongKeyOrModifiedCiphertextException $e) { / expected / } } /* * Test HKDF against test vectors. * * @throws Ex\EnvironmentIsBrokenException * @return void / private static function HKDFTestVector() { // HKDF test vectors from RFC 5869 // Test Case 1 $ikm = \str_repeat("\x0b", 22); $salt = Encoding::hexToBin('000102030405060708090a0b0c'); $info = Encoding::hexToBin('f0f1f2f3f4f5f6f7f8f9'); $length = 42; $okm = Encoding::hexToBin( '3cb25f25faacd57a90434f64d0362f2a' . '2d2d0a90cf1a5a4c5db02d56ecc4c5bf' . '34007208d5b887185865' ); $computed_okm = Core::HKDF('sha256', $ikm, $length, $info, $salt); Core::ensureTrue($computed_okm === $okm); // Test Case 7 $ikm = \str_repeat("\x0c", 22); $length = 42; $okm = Encoding::hexToBin( '2c91117204d745f3500d636a62f64f0a' . 'b3bae548aa53d423b0d1f27ebba6f5e5' . '673a081d70cce7acfc48' ); $computed_okm = Core::HKDF('sha1', $ikm, $length, '', null); Core::ensureTrue($computed_okm === $okm); } /* * Test HMAC against test vectors. * * @throws Ex\EnvironmentIsBrokenException * @return void / private static function HMACTestVector() { // HMAC test vector From RFC 4231 (Test Case 1) $key = \str_repeat("\x0b", 20); $data = 'Hi There'; $correct = 'b0344c61d8db38535ca8afceaf0bf12b881dc200c9833da726e9376c2e32cff7'; Core::ensureTrue( \hash_hmac(Core::HASH_FUNCTION_NAME, $data, $key) === $correct ); } /* * Test AES against test vectors. * * @throws Ex\EnvironmentIsBrokenException * @return void / private static function AESTestVector() { // AES CTR mode test vector from NIST SP 800-38A $key = Encoding::hexToBin( '603deb1015ca71be2b73aef0857d7781' . '1f352c073b6108d72d9810a30914dff4' ); $iv = Encoding::hexToBin('f0f1f2f3f4f5f6f7f8f9fafbfcfdfeff'); $plaintext = Encoding::hexToBin( '6bc1bee22e409f96e93d7e117393172a' . 'ae2d8a571e03ac9c9eb76fac45af8e51' . '30c81c46a35ce411e5fbc1191a0a52ef' . 'f69f2445df4f9b17ad2b417be66c3710' ); $ciphertext = Encoding::hexToBin( '601ec313775789a5b7a7f504bbf3d228' . 'f443e3ca4d62b59aca84e990cacaf5c5' . '2b0930daa23de94ce87017ba2d84988d' . 'dfc9c58db67aada613c2dd08457941a6' ); $computed_ciphertext = Crypto::plainEncrypt($plaintext, $key, $iv); Core::ensureTrue($computed_ciphertext === $ciphertext); $computed_plaintext = Crypto::plainDecrypt($ciphertext, $key, $iv, Core::CIPHER_METHOD); Core::ensureTrue($computed_plaintext === $plaintext); } } PK��r�\q(P ��P ��php-encryption/src/Key.phpnu��[��<?php namespace Defuse\Crypto; use Defuse\Crypto\Exception as Ex; final class Key { const KEY_CURRENT_VERSION = "\xDE\xF0\x00\x00"; const KEY_BYTE_SIZE = 32; /* * @var string / private $key_bytes; /* * Creates new random key. * * @throws Ex\EnvironmentIsBrokenException * * @return Key / public static function createNewRandomKey() { return new Key(Core::secureRandom(self::KEY_BYTE_SIZE)); } /* * Loads a Key from its encoded form. * * By default, this function will call Encoding::trimTrailingWhitespace() * to remove trailing CR, LF, NUL, TAB, and SPACE characters, which are * commonly appended to files when working with text editors. * * @param string $saved_key_string * @param bool $do_not_trim (default: false) * * @throws Ex\BadFormatException * @throws Ex\EnvironmentIsBrokenException * * @return Key / public static function loadFromAsciiSafeString( #[\SensitiveParameter] $saved_key_string, $do_not_trim = false ) { if (!$do_not_trim) { $saved_key_string = Encoding::trimTrailingWhitespace($saved_key_string); } $key_bytes = Encoding::loadBytesFromChecksummedAsciiSafeString(self::KEY_CURRENT_VERSION, $saved_key_string); return new Key($key_bytes); } /* * Encodes the Key into a string of printable ASCII characters. * * @throws Ex\EnvironmentIsBrokenException * * @return string / public function saveToAsciiSafeString() { return Encoding::saveBytesToChecksummedAsciiSafeString( self::KEY_CURRENT_VERSION, $this->key_bytes ); } /* * Gets the raw bytes of the key. * * @return string / public function getRawBytes() { return $this->key_bytes; } /* * Constructs a new Key object from a string of raw bytes. * * @param string $bytes * * @throws Ex\EnvironmentIsBrokenException / private function __construct( #[\SensitiveParameter] $bytes ) { Core::ensureTrue( Core::ourStrlen($bytes) === self::KEY_BYTE_SIZE, 'Bad key length.' ); $this->key_bytes = $bytes; } } PK��r�\��X��X��0��php-encryption/src/Exception/CryptoException.phpnu��[��<?php namespace Defuse\Crypto\Exception; class CryptoException extends \Exception { } PK��r�\d�+M��F��php-encryption/src/Exception/WrongKeyOrModifiedCiphertextException.phpnu��[��<?php namespace Defuse\Crypto\Exception; class WrongKeyOrModifiedCiphertextException extends \Defuse\Crypto\Exception\CryptoException { } PK��r�\ ��=��php-encryption/src/Exception/EnvironmentIsBrokenException.phpnu��[��<?php namespace Defuse\Crypto\Exception; class EnvironmentIsBrokenException extends \Defuse\Crypto\Exception\CryptoException { } PK��r�\"i&�r��r��,��php-encryption/src/Exception/IOException.phpnu��[��<?php namespace Defuse\Crypto\Exception; class IOException extends \Defuse\Crypto\Exception\CryptoException { } PK��r�\=��y��y��3��php-encryption/src/Exception/BadFormatException.phpnu��[��<?php namespace Defuse\Crypto\Exception; class BadFormatException extends \Defuse\Crypto\Exception\CryptoException { } PK��r�\�?��k��k��php-encryption/src/File.phpnu��[��<?php namespace Defuse\Crypto; use Defuse\Crypto\Exception as Ex; final class File { /** * Encrypts the input file, saving the ciphertext to the output file. * * @param string $inputFilename * @param string $outputFilename * @param Key $key * @return void * * @throws Ex\EnvironmentIsBrokenException * @throws Ex\IOException / public static function encryptFile($inputFilename, $outputFilename, Key $key) { self::encryptFileInternal( $inputFilename, $outputFilename, KeyOrPassword::createFromKey($key) ); } /* * Encrypts a file with a password, using a slow key derivation function to * make password cracking more expensive. * * @param string $inputFilename * @param string $outputFilename * @param string $password * @return void * * @throws Ex\EnvironmentIsBrokenException * @throws Ex\IOException / public static function encryptFileWithPassword( $inputFilename, $outputFilename, #[\SensitiveParameter] $password ) { self::encryptFileInternal( $inputFilename, $outputFilename, KeyOrPassword::createFromPassword($password) ); } /* * Decrypts the input file, saving the plaintext to the output file. * * @param string $inputFilename * @param string $outputFilename * @param Key $key * @return void * * @throws Ex\EnvironmentIsBrokenException * @throws Ex\IOException * @throws Ex\WrongKeyOrModifiedCiphertextException / public static function decryptFile($inputFilename, $outputFilename, Key $key) { self::decryptFileInternal( $inputFilename, $outputFilename, KeyOrPassword::createFromKey($key) ); } /* * Decrypts a file with a password, using a slow key derivation function to * make password cracking more expensive. * * @param string $inputFilename * @param string $outputFilename * @param string $password * @return void * * @throws Ex\EnvironmentIsBrokenException * @throws Ex\IOException * @throws Ex\WrongKeyOrModifiedCiphertextException / public static function decryptFileWithPassword( $inputFilename, $outputFilename, #[\SensitiveParameter] $password ) { self::decryptFileInternal( $inputFilename, $outputFilename, KeyOrPassword::createFromPassword($password) ); } /* * Takes two resource handles and encrypts the contents of the first, * writing the ciphertext into the second. * * @param resource $inputHandle * @param resource $outputHandle * @param Key $key * @return void * * @throws Ex\EnvironmentIsBrokenException * @throws Ex\WrongKeyOrModifiedCiphertextException / public static function encryptResource($inputHandle, $outputHandle, Key $key) { self::encryptResourceInternal( $inputHandle, $outputHandle, KeyOrPassword::createFromKey($key) ); } /* * Encrypts the contents of one resource handle into another with a * password, using a slow key derivation function to make password cracking * more expensive. * * @param resource $inputHandle * @param resource $outputHandle * @param string $password * @return void * * @throws Ex\EnvironmentIsBrokenException * @throws Ex\IOException * @throws Ex\WrongKeyOrModifiedCiphertextException / public static function encryptResourceWithPassword( $inputHandle, $outputHandle, #[\SensitiveParameter] $password ) { self::encryptResourceInternal( $inputHandle, $outputHandle, KeyOrPassword::createFromPassword($password) ); } /* * Takes two resource handles and decrypts the contents of the first, * writing the plaintext into the second. * * @param resource $inputHandle * @param resource $outputHandle * @param Key $key * @return void * * @throws Ex\EnvironmentIsBrokenException * @throws Ex\IOException * @throws Ex\WrongKeyOrModifiedCiphertextException / public static function decryptResource($inputHandle, $outputHandle, Key $key) { self::decryptResourceInternal( $inputHandle, $outputHandle, KeyOrPassword::createFromKey($key) ); } /* * Decrypts the contents of one resource into another with a password, using * a slow key derivation function to make password cracking more expensive. * * @param resource $inputHandle * @param resource $outputHandle * @param string $password * @return void * * @throws Ex\EnvironmentIsBrokenException * @throws Ex\IOException * @throws Ex\WrongKeyOrModifiedCiphertextException / public static function decryptResourceWithPassword( $inputHandle, $outputHandle, #[\SensitiveParameter] $password ) { self::decryptResourceInternal( $inputHandle, $outputHandle, KeyOrPassword::createFromPassword($password) ); } /* * Encrypts a file with either a key or a password. * * @param string $inputFilename * @param string $outputFilename * @param KeyOrPassword $secret * @return void * * @throws Ex\CryptoException * @throws Ex\IOException / private static function encryptFileInternal($inputFilename, $outputFilename, KeyOrPassword $secret) { if (file_exists($inputFilename) && file_exists($outputFilename) && realpath($inputFilename) === realpath($outputFilename)) { throw new Ex\IOException('Input and output filenames must be different.'); } / Open the input file. / self::removePHPUnitErrorHandler(); $if = @\fopen($inputFilename, 'rb'); self::restorePHPUnitErrorHandler(); if ($if === false) { throw new Ex\IOException( 'Cannot open input file for encrypting: ' . self::getLastErrorMessage() ); } if (\is_callable('\\stream_set_read_buffer')) { / This call can fail, but the only consequence is performance. / \stream_set_read_buffer($if, 0); } / Open the output file. / self::removePHPUnitErrorHandler(); $of = @\fopen($outputFilename, 'wb'); self::restorePHPUnitErrorHandler(); if ($of === false) { \fclose($if); throw new Ex\IOException( 'Cannot open output file for encrypting: ' . self::getLastErrorMessage() ); } if (\is_callable('\\stream_set_write_buffer')) { / This call can fail, but the only consequence is performance. / \stream_set_write_buffer($of, 0); } / Perform the encryption. / try { self::encryptResourceInternal($if, $of, $secret); } catch (Ex\CryptoException $ex) { \fclose($if); \fclose($of); throw $ex; } / Close the input file. / if (\fclose($if) === false) { \fclose($of); throw new Ex\IOException( 'Cannot close input file after encrypting' ); } / Close the output file. / if (\fclose($of) === false) { throw new Ex\IOException( 'Cannot close output file after encrypting' ); } } /* * Decrypts a file with either a key or a password. * * @param string $inputFilename * @param string $outputFilename * @param KeyOrPassword $secret * @return void * * @throws Ex\CryptoException * @throws Ex\IOException / private static function decryptFileInternal($inputFilename, $outputFilename, KeyOrPassword $secret) { if (file_exists($inputFilename) && file_exists($outputFilename) && realpath($inputFilename) === realpath($outputFilename)) { throw new Ex\IOException('Input and output filenames must be different.'); } / Open the input file. / self::removePHPUnitErrorHandler(); $if = @\fopen($inputFilename, 'rb'); self::restorePHPUnitErrorHandler(); if ($if === false) { throw new Ex\IOException( 'Cannot open input file for decrypting: ' . self::getLastErrorMessage() ); } if (\is_callable('\\stream_set_read_buffer')) { / This call can fail, but the only consequence is performance. / \stream_set_read_buffer($if, 0); } / Open the output file. / self::removePHPUnitErrorHandler(); $of = @\fopen($outputFilename, 'wb'); self::restorePHPUnitErrorHandler(); if ($of === false) { \fclose($if); throw new Ex\IOException( 'Cannot open output file for decrypting: ' . self::getLastErrorMessage() ); } if (\is_callable('\\stream_set_write_buffer')) { / This call can fail, but the only consequence is performance. / \stream_set_write_buffer($of, 0); } / Perform the decryption. / try { self::decryptResourceInternal($if, $of, $secret); } catch (Ex\CryptoException $ex) { \fclose($if); \fclose($of); throw $ex; } / Close the input file. / if (\fclose($if) === false) { \fclose($of); throw new Ex\IOException( 'Cannot close input file after decrypting' ); } / Close the output file. / if (\fclose($of) === false) { throw new Ex\IOException( 'Cannot close output file after decrypting' ); } } /* * Encrypts a resource with either a key or a password. * * @param resource $inputHandle * @param resource $outputHandle * @param KeyOrPassword $secret * @return void * * @throws Ex\EnvironmentIsBrokenException * @throws Ex\IOException * @psalm-suppress PossiblyInvalidArgument * Fixes erroneous errors caused by PHP 7.2 switching the return value * of hash_init from a resource to a HashContext. / private static function encryptResourceInternal($inputHandle, $outputHandle, KeyOrPassword $secret) { if (! \is_resource($inputHandle)) { throw new Ex\IOException( 'Input handle must be a resource!' ); } if (! \is_resource($outputHandle)) { throw new Ex\IOException( 'Output handle must be a resource!' ); } $inputStat = \fstat($inputHandle); $inputSize = $inputStat['size']; $file_salt = Core::secureRandom(Core::SALT_BYTE_SIZE); $keys = $secret->deriveKeys($file_salt); $ekey = $keys->getEncryptionKey(); $akey = $keys->getAuthenticationKey(); $ivsize = Core::BLOCK_BYTE_SIZE; $iv = Core::secureRandom($ivsize); / Initialize a streaming HMAC state. / /* @var mixed $hmac / $hmac = \hash_init(Core::HASH_FUNCTION_NAME, HASH_HMAC, $akey); Core::ensureTrue( \is_resource($hmac) \|\| \is_object($hmac), 'Cannot initialize a hash context' ); / Write the header, salt, and IV. / self::writeBytes( $outputHandle, Core::CURRENT_VERSION . $file_salt . $iv, Core::HEADER_VERSION_SIZE + Core::SALT_BYTE_SIZE + $ivsize ); / Add the header, salt, and IV to the HMAC. / \hash_update($hmac, Core::CURRENT_VERSION); \hash_update($hmac, $file_salt); \hash_update($hmac, $iv); / $thisIv will be incremented after each call to the encryption. / $thisIv = $iv; / How many blocks do we encrypt at a time? We increment by this value. / /* * @psalm-suppress RedundantCast / $inc = (int) (Core::BUFFER_BYTE_SIZE / Core::BLOCK_BYTE_SIZE); / Loop until we reach the end of the input file. / $at_file_end = false; while (! (\feof($inputHandle) \|\| $at_file_end)) { / Find out if we can read a full buffer, or only a partial one. / /* @var int / $pos = \ftell($inputHandle); if (!\is_int($pos)) { throw new Ex\IOException( 'Could not get current position in input file during encryption' ); } if ($pos + Core::BUFFER_BYTE_SIZE >= $inputSize) { / We're at the end of the file, so we need to break out of the loop. / $at_file_end = true; $read = self::readBytes( $inputHandle, $inputSize - $pos ); } else { $read = self::readBytes( $inputHandle, Core::BUFFER_BYTE_SIZE ); } / Encrypt this buffer. / /* @var string / $encrypted = \openssl_encrypt( $read, Core::CIPHER_METHOD, $ekey, OPENSSL_RAW_DATA, $thisIv ); Core::ensureTrue(\is_string($encrypted), 'OpenSSL encryption error'); / Write this buffer's ciphertext. / self::writeBytes($outputHandle, $encrypted, Core::ourStrlen($encrypted)); / Add this buffer's ciphertext to the HMAC. / \hash_update($hmac, $encrypted); / Increment the counter by the number of blocks in a buffer. / $thisIv = Core::incrementCounter($thisIv, $inc); / WARNING: Usually, unless the file is a multiple of the buffer * size, $thisIv will contain an incorrect value here on the last * iteration of this loop. / } / Get the HMAC and append it to the ciphertext. / $final_mac = \hash_final($hmac, true); self::writeBytes($outputHandle, $final_mac, Core::MAC_BYTE_SIZE); } /* * Decrypts a file-backed resource with either a key or a password. * * @param resource $inputHandle * @param resource $outputHandle * @param KeyOrPassword $secret * @return void * * @throws Ex\EnvironmentIsBrokenException * @throws Ex\IOException * @throws Ex\WrongKeyOrModifiedCiphertextException * @psalm-suppress PossiblyInvalidArgument * Fixes erroneous errors caused by PHP 7.2 switching the return value * of hash_init from a resource to a HashContext. / public static function decryptResourceInternal($inputHandle, $outputHandle, KeyOrPassword $secret) { if (! \is_resource($inputHandle)) { throw new Ex\IOException( 'Input handle must be a resource!' ); } if (! \is_resource($outputHandle)) { throw new Ex\IOException( 'Output handle must be a resource!' ); } / Make sure the file is big enough for all the reads we need to do. / $stat = \fstat($inputHandle); if ($stat['size'] < Core::MINIMUM_CIPHERTEXT_SIZE) { throw new Ex\WrongKeyOrModifiedCiphertextException( 'Input file is too small to have been created by this library.' ); } / Check the version header. / $header = self::readBytes($inputHandle, Core::HEADER_VERSION_SIZE); if ($header !== Core::CURRENT_VERSION) { throw new Ex\WrongKeyOrModifiedCiphertextException( 'Bad version header.' ); } / Get the salt. / $file_salt = self::readBytes($inputHandle, Core::SALT_BYTE_SIZE); / Get the IV. / $ivsize = Core::BLOCK_BYTE_SIZE; $iv = self::readBytes($inputHandle, $ivsize); / Derive the authentication and encryption keys. / $keys = $secret->deriveKeys($file_salt); $ekey = $keys->getEncryptionKey(); $akey = $keys->getAuthenticationKey(); / We'll store the MAC of each buffer-sized chunk as we verify the * actual MAC, so that we can check them again when decrypting. / $macs = []; / $thisIv will be incremented after each call to the decryption. / $thisIv = $iv; / How many blocks do we encrypt at a time? We increment by this value. / /* * @psalm-suppress RedundantCast / $inc = (int) (Core::BUFFER_BYTE_SIZE / Core::BLOCK_BYTE_SIZE); / Get the HMAC. / if (\fseek($inputHandle, (-1 Core::MAC_BYTE_SIZE), SEEK_END) === -1) { throw new Ex\IOException( 'Cannot seek to beginning of MAC within input file' ); } /* Get the position of the last byte in the actual ciphertext. / /* @var int $cipher_end / $cipher_end = \ftell($inputHandle); if (!\is_int($cipher_end)) { throw new Ex\IOException( 'Cannot read input file' ); } / We have the position of the first byte of the HMAC. Go back by one. / --$cipher_end; / Read the HMAC. / /* @var string $stored_mac / $stored_mac = self::readBytes($inputHandle, Core::MAC_BYTE_SIZE); / Initialize a streaming HMAC state. / /* @var mixed $hmac / $hmac = \hash_init(Core::HASH_FUNCTION_NAME, HASH_HMAC, $akey); Core::ensureTrue(\is_resource($hmac) \|\| \is_object($hmac), 'Cannot initialize a hash context'); / Reset file pointer to the beginning of the file after the header / if (\fseek($inputHandle, Core::HEADER_VERSION_SIZE, SEEK_SET) === -1) { throw new Ex\IOException( 'Cannot read seek within input file' ); } / Seek to the start of the actual ciphertext. / if (\fseek($inputHandle, Core::SALT_BYTE_SIZE + $ivsize, SEEK_CUR) === -1) { throw new Ex\IOException( 'Cannot seek input file to beginning of ciphertext' ); } / PASS #1: Calculating the HMAC. / \hash_update($hmac, $header); \hash_update($hmac, $file_salt); \hash_update($hmac, $iv); /* @var mixed $hmac2 / $hmac2 = \hash_copy($hmac); $break = false; while (! $break) { /* @var int $pos / $pos = \ftell($inputHandle); if (!\is_int($pos)) { throw new Ex\IOException( 'Could not get current position in input file during decryption' ); } / Read the next buffer-sized chunk (or less). / if ($pos + Core::BUFFER_BYTE_SIZE >= $cipher_end) { $break = true; $read = self::readBytes( $inputHandle, $cipher_end - $pos + 1 ); } else { $read = self::readBytes( $inputHandle, Core::BUFFER_BYTE_SIZE ); } / Update the HMAC. / \hash_update($hmac, $read); / Remember this buffer-sized chunk's HMAC. / /* @var mixed $chunk_mac / $chunk_mac = \hash_copy($hmac); Core::ensureTrue(\is_resource($chunk_mac) \|\| \is_object($chunk_mac), 'Cannot duplicate a hash context'); $macs []= \hash_final($chunk_mac); } / Get the final HMAC, which should match the stored one. / /* @var string $final_mac / $final_mac = \hash_final($hmac, true); / Verify the HMAC. / if (! Core::hashEquals($final_mac, $stored_mac)) { throw new Ex\WrongKeyOrModifiedCiphertextException( 'Integrity check failed.' ); } / PASS #2: Decrypt and write output. / / Rewind to the start of the actual ciphertext. / if (\fseek($inputHandle, Core::SALT_BYTE_SIZE + $ivsize + Core::HEADER_VERSION_SIZE, SEEK_SET) === -1) { throw new Ex\IOException( 'Could not move the input file pointer during decryption' ); } $at_file_end = false; while (! $at_file_end) { /* @var int $pos / $pos = \ftell($inputHandle); if (!\is_int($pos)) { throw new Ex\IOException( 'Could not get current position in input file during decryption' ); } / Read the next buffer-sized chunk (or less). / if ($pos + Core::BUFFER_BYTE_SIZE >= $cipher_end) { $at_file_end = true; $read = self::readBytes( $inputHandle, $cipher_end - $pos + 1 ); } else { $read = self::readBytes( $inputHandle, Core::BUFFER_BYTE_SIZE ); } / Recalculate the MAC (so far) and compare it with the one we * remembered from pass #1 to ensure attackers didn't change the * ciphertext after MAC verification. / \hash_update($hmac2, $read); /* @var mixed $calc_mac / $calc_mac = \hash_copy($hmac2); Core::ensureTrue(\is_resource($calc_mac) \|\| \is_object($calc_mac), 'Cannot duplicate a hash context'); $calc = \hash_final($calc_mac); if (empty($macs)) { throw new Ex\WrongKeyOrModifiedCiphertextException( 'File was modified after MAC verification' ); } elseif (! Core::hashEquals(\array_shift($macs), $calc)) { throw new Ex\WrongKeyOrModifiedCiphertextException( 'File was modified after MAC verification' ); } / Decrypt this buffer-sized chunk. / /* @var string $decrypted / $decrypted = \openssl_decrypt( $read, Core::CIPHER_METHOD, $ekey, OPENSSL_RAW_DATA, $thisIv ); Core::ensureTrue(\is_string($decrypted), 'OpenSSL decryption error'); / Write the plaintext to the output file. / self::writeBytes( $outputHandle, $decrypted, Core::ourStrlen($decrypted) ); / Increment the IV by the amount of blocks in a buffer. / /* @var string $thisIv / $thisIv = Core::incrementCounter($thisIv, $inc); / WARNING: Usually, unless the file is a multiple of the buffer * size, $thisIv will contain an incorrect value here on the last * iteration of this loop. / } } /* * Read from a stream; prevent partial reads. * * @param resource $stream * @param int $num_bytes * @return string * * @throws Ex\IOException * @throws Ex\EnvironmentIsBrokenException / public static function readBytes($stream, $num_bytes) { Core::ensureTrue($num_bytes >= 0, 'Tried to read less than 0 bytes'); if ($num_bytes === 0) { return ''; } $buf = ''; $remaining = $num_bytes; while ($remaining > 0 && ! \feof($stream)) { /* @var string $read / $read = \fread($stream, $remaining); if (!\is_string($read)) { throw new Ex\IOException( 'Could not read from the file' ); } $buf .= $read; $remaining -= Core::ourStrlen($read); } if (Core::ourStrlen($buf) !== $num_bytes) { throw new Ex\IOException( 'Tried to read past the end of the file' ); } return $buf; } /* * Write to a stream; prevents partial writes. * * @param resource $stream * @param string $buf * @param int $num_bytes * @return int * * @throws Ex\IOException / public static function writeBytes($stream, $buf, $num_bytes = null) { $bufSize = Core::ourStrlen($buf); if ($num_bytes === null) { $num_bytes = $bufSize; } if ($num_bytes > $bufSize) { throw new Ex\IOException( 'Trying to write more bytes than the buffer contains.' ); } if ($num_bytes < 0) { throw new Ex\IOException( 'Tried to write less than 0 bytes' ); } $remaining = $num_bytes; while ($remaining > 0) { /* @var int $written / $written = \fwrite($stream, $buf, $remaining); if (!\is_int($written)) { throw new Ex\IOException( 'Could not write to the file' ); } $buf = (string) Core::ourSubstr($buf, $written, null); $remaining -= $written; } return $num_bytes; } /* * Returns the last PHP error's or warning's message string. * * @return string / private static function getLastErrorMessage() { $error = error_get_last(); if ($error === null) { return '[no PHP error, or you have a custom error handler set]'; } else { return $error['message']; } } /* * PHPUnit sets an error handler, which prevents getLastErrorMessage() from working, * because error_get_last does not work when custom handlers are set. * * This is a workaround, which should be a no-op in production deployments, to make * getLastErrorMessage() return the error messages that the PHPUnit tests expect. * * If, in a production deployment, a custom error handler is set, the exception * handling will still work as usual, but the error messages will be confusing. * * @return void / private static function removePHPUnitErrorHandler() { if (defined('PHPUNIT_COMPOSER_INSTALL') \|\| defined('__PHPUNIT_PHAR__')) { set_error_handler(null); } } /* * Undoes what removePHPUnitErrorHandler did. * * @return void / private static function restorePHPUnitErrorHandler() { if (defined('PHPUNIT_COMPOSER_INSTALL') \|\| defined('__PHPUNIT_PHAR__')) { restore_error_handler(); } } } PK��r�\J�9ї��php-encryption/LICENSEnu��[��The MIT License (MIT) Copyright (c) 2016 Taylor Hornby <https://defuse.ca> Copyright (c) 2016 Paragon Initiative Enterprises <https://paragonie.com>. Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. PK��r�\��"����&��php-encryption/bin/generate-defuse-keynu��[��#!/usr/bin/env php <?php use Defuse\Crypto\Key; foreach ([__DIR__ . '/../../../autoload.php', __DIR__ . '/../vendor/autoload.php'] as $file) { if (file_exists($file)) { require $file; break; } } $key = Key::createNewRandomKey(); echo $key->saveToAsciiSafeString(), "\n"; PK��r�\� r� �� "��php-encryption/dist/signingkey.ascnu��[��-----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v2 mQINBFarvO4BEACdQBaLt6SUBx1cB5liUu1qo+YwVLh9bxTregQtmEREMdTVqXYt e5b79uL4pQp2GlKHcEyRURS+6rIIruM0oh9ZYGTJYPAkCDzJxaU2awZeFbfBvpCm iF66/O4ZJI4mlT8dFKmxBJxDhfeOR2UmmhDiEsJK9FxBKUzvo/dWrX2pBzf8Y122 iIaVraSo+tymaf7vriaIf/NnSKhDw8dtQYGM4NMrxxsPTfbCF8XiboDgTkoD2A+6 NpOJYxA4Veedsf2TP9YLhljH4m5yYlfjjqBzbBCPWuE6Hhy5Xze9mncgDr7LKenm Ctf2NxW6y4O3RCI+9eLlBfFWB+KuGV87/b5daetX7NNLbjID8z2rqEa+d6wu5xA5 Ta2uiVkAOEovr3XnkayZ9zth+Za7w7Ai0ln0N/LVMkM+Gu4z/pJv6HjmTGDM2wJb fs+UOM0TFdg+N81Do67XT2M4o0MeHyUqsIiWpYa2Qf1PNmqTQNJnRk8uZZ9I96Nh eCgNuCbhsQiYBMicox+xmuWAlGAfA06y0kCtmqGhiBGArdJlWvUqPqGiZ4Hln9z0 FJmXDOh0Q/FIPxcDg8mKRRbx+lOP389PLsPpj4b2B/4PEgfpCCOwuKpLotATZxC1 9JwFk0Y/cvUUkq4a+nAJBNtBbtRJkEesuuUnRq6XexmnE3uUucDcV0XCSwARAQAB tCBUYXlsb3IgSG9ybmJ5IDx0YXlsb3JAZGVmdXNlLmNhPokCPQQTAQgAJwUCVqu8 7gIbAwUJB4TOAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRA4XuBVoSkVOJbx EACG0F9blPMAsK05EWyNnnS4mw25zPfbaqqEvYbquAeM0nBpRDm7sRn2MNR0AL4g 7XrtxE/4qYkdEl6f2wFCQeRhZgxE3w22llredzLme11Hic8hn4i7ysdIw0r9dMMR kjgR5UcWpv8iU847czyK09PkKW2EaLRbX2qbA7rNU5qCFKeD4Sy4bBTteISeVsHo Vr9o1/bRrMhgZ++ts8hYf0LmujIf5cxp+qcdKwCXSnS/gmmXaKRMCPv/Wdlq9bt6 LX9jZB9lXBdGxcBJeFOsTG+QRDiVjg3d6i3o3TAKV87ALBI4v2ADEYtN8lviHo3/ SovVKv6zrUsZHxhoGiLTiksNrYsKMmiMxdJCoOazmtUPnZ4UOtT8NdqMPoKvdoRz f4rhZ+f5jSVD9OuX2PDmfyq21Rdiym7Vcgr+uTIFJ3ShRHjWb/ytCwoB2FeGY6+G AKY58bTQvUIqEJvSov/+TAqZ4BfOuSdTLcHglV1OdUu2SFZvU2gmyVp0l5elGv5t FyUlBJUkQT9MtvsdLOR7vQi8QapV+9LWpqwvaj9hyEJz848DQ2sdYTphUytFHv7H k58DAtVhTrVjHyeefjiYtMl6vSAgTjy5LWAUpo5TfhdGrAi0Tdd/GD7amHoWoDy8 EKXKq2xPLo3JOdkWYQUi5NErzEskfsSzpCOgyDJmGetWK7kCDQRWq7zuARAAu7/i cm8cjgLhHEX/bgfwOT2hLOLSjjve0O8YFSuJO9XqIHXqmfVOrqWtfG0Mh4bwlfqc MAvBfF5NSSPfAE4ftBAQ1e5jEv8hJeqICpq3IHTFX4etBs49NfNkyveQl/amVTu1 +/O5J4CuIcsEf3y0Xuu38n7EB3SfMQCWLcOR1NyZoX3bI+CGRpOVVoFse3ljSWL4 LhLVl0WiEMXULsussEoN+c6x9KCyAi/jFOrxrTrFC//sZesKj6KucoqKGfwMWrrv IeRT9Ga8Wn5MJnQu0aWg+zVVYqTedXZLNLODgQIInFnXO0seBXy15yDok1y5bkx2 sinKg4+mueYaGUpoUti0hM3J3yaC34i6Cwa8MQoLNw1JIS/oNtKjpMxyV10w8aoc PHRK3n7UYp10mJHx7aM+lldSKvVS1NTQmI4vloNLwMp324H5ANDFAlRUz7mysVnu DEEvigPSPxs5ZYENu/i7pCQC5qHfhrlBrQwTjhegr0pQPcumy2fO5SGC9l/5B7ev bqQSZmDeWWoTvh2w2wl5/RWAsgZKx6rDtkCqYx7sSBY17uorrxP24LP4zhq7NxRV nfdsLogbCFNVQ66u7qvq5zFccdFtg9h1HQWdS7wbnKSBGZoo5gl6js7GGtxfGbb0 oQ9kp6eciF4U92r6POhVgbRe4CfPo50nqgZBddkAEQEAAYkCJQQYAQgADwUCVqu8 7gIbDAUJB4TOAAAKCRA4XuBVoSkVOFJ8D/9J8IJ4XWUU3FYIaHJ3XeSoxDmTi7d5 WmNdf1lmwz82MQjG4uw17oCbvQzmj4/a/CM1Ly4v0WwBhUf9aiNErD0ByHASFnuc tlQBLVJdk0vRyD0fZakGg64qCA76hiySjMhlGHkQFyP2mDORc2GNu/OqFGm79pXT ZUplXxd431E603/agM5xJrweutMMpP1nBFTSEMJvbMNzDVN8I1A1CH4zVmAVxOUk sQ5L5rXW+KeXWyiMF24+l2CMnkQ2CxfHpkcpfPJs1Cbt+TIBSSofIqK8QJXrb/2f Zpl/ftqW7Xe86rJFrB/Y/77LDWx10rqWEvfCqrBxrMj7ONAQfbKQF/IjAwDN17Wf 1K74rqKnRu+KHCyNM89s1iDbQC9kzZfzYt4AEOvAH/ZQDMZffzPSbnfkBerExFpa 93XMuiR66jiBsf9IXIQeydpJD4Ogl2sSUSxFEJxJ/bBSxPxC5w7/BVMA7Am1y8Zo 3hrpqnX2PBzxG7L0FZ6fYkfR3p8JS7vI6nByBf2IDv8W32wn43olPf+u6uobHLvt ttapOjwPAhPDalRuxs9U6WSg06QJkT/0F8TFUPWpsFmKTl+G4Ty7PHWsjeeNHJCL 7/5RQboFY3k8Jy3/sIofABO6Un9LJivDuu9PxqA0IgvaS6Mja8JdCCk9Nyk4vHB7 IEgAL/CYqrk38w== =lmD7 -----END PGP PUBLIC KEY BLOCK----- PK��r�\�W��-��php-encryption/dist/phar-testing-autoload.phpnu��[��<?php require 'defuse-crypto.phar'; require realpath(dirname(__FILE__) . '/../vendor/yoast/phpunit-polyfills/phpunitpolyfills-autoload.php'); ?> PK��r�\"R�4��&��php-encryption/dist/signingkey-new.ascnu��[��-----BEGIN PGP PUBLIC KEY BLOCK----- mQINBF5V4TABEAC4G2BkHDaqbip3gj1oOqKh3V6LQa9QAd/f/hyhmR5hXpciPxf3 NNHAxzoGAuB51f1YPJTNO59mGKHDuCFfr0pI94HDGoW4WgxqnUyqHBj2+/JhQPqO lgDT0QDcfxmUd0wfZl/Ur+8SsaBYvfFWNmPaXHp9m4MMRtw9uZNIW6LlZ24JqmGy /YUELUSH7P+uJ4HQEdixaqQ0VgIomRDI+5IwdJMtq4TSNazQm3nNmH9Em37cdi6J NDfFRy2QxJDmuqlg8mkpS5TvrrNy/UJwIeXO9PuGaBODr8GAKWvhkpfGlxN+hWMY 01bOFnuEnOcuXw8BjPAKHqwOuGvinNmQ7lX1Rj3ssd31sTUimop0oNjOTZztpJBR m6wO2/YGMjt+eL02NgBBDIsV837PeWuJmymTJDGQuBjZ3JWUfyT3AnkA8OU5vKjs pM8AjIiuU7C8zQhUSHDnukTKWpBmMdOXeWNb5Ye6n60wJWzWFGlm+cYalPs+q3H8 bxHxHEdFT0rUpxB05bc9zsZ3gGkc2NTNW/00a6gvTyX1UsBAeNgvVSHBHQGfow6o ZKG+LnVxd+cl97ay6kP29eLypXffbXQ3hMXe9tUNBjAeiok9tssU70Epr9wTh/Fm /iEbGc8VhS4TSk3c+3eS16rvlQ51FmAlmG6kAnN/ah+BiM4syPrWcJHIDQARAQAB tG1kZWZ1c2UvcGhwLWVuY3J5cHRpb24gbWFpbnRhaW5lcnMgKGRlZnVzZS9waHAt ZW5jcnlwdGlvbiByZWxlYXNlIHNpZ25pbmcga2V5KSA8cGhwLWVuY3J5cHRpb25A ZGVmdXNlLmludmFsaWQ+iQJUBBMBCAA+FiEEbdbmdwKBWEb8hSWj3S5Qf3vbFmkF Al5V4TACGwMFCQlmAYAFCwkIBwIGFQoJCAsCBBYCAwECHgECF4AACgkQ3S5Qf3vb FmnQ4Q//bHAwDI7CcTlDDktdRCP0YCRtb5zMa6vSqnZLi5aTqzmL1yQCAp1/JTwf nlHn5xt60eKwfjIKj7Kj0n8WDFYnlOu30H5fNtFHis0xeS7GkH60tIE/pQUZILlB Wcnx/ZPnlxccjtfSbnpelSPdvIoHVRNhh1ZYG/49kuuv8TMbMIi2FBAzGEatPoLN f4wntoOKGvl8R2rPc2geapXTz++X+HJkddHCISR61obDRl9P0t9x+0M7gGSVMGfC GC4wh3JB6/ha8l+DI+l88/64IKRG+M33bBwLGQ0RIhotHIy442gLJTm6TeoH8iUz xCBwPYW+Ta1wZi17PIjHdTkNGBeEj/Hr5tTVV3oxrQVgHCymzasnz9IwcCCMwpKK ZOMFl0+PT3TSBKLnUByvOB64YOjxU7t+sRf53Biz3yKzto5VdHGW64OG2vGFy/Xz vI5RqU34wjtEHxWfz8y2GBnhD2TzEFCIIWPAX3TDG64NBSEBjhUraOmoVoaYJlP6 rqxIQo4yhC+f5rnr2ZA48Hnrg0jEdVvN07FegoOnQQPpYBBkOrkTDWChn8oiXMfg 9bjv19zDOBVXl9EU+P8AhwTHz/pBKmhb97N9nYp/pbmejA+I0Kw1vZo7gaMxL938 oQkdtWT70ZzcpcZfeKVXoZa/ddAmuxzNknZA8ZnjQ9Qhv7aNX2O5Ag0EXlXhMAEQ AM8od4/85i7ZPmM6C1M4n4XcXeKsuZKHLvLLcRHFGkjVdXRSaxpbk2yDJiLnB9hX GSJG2gUCT+yrimjQ71bJ4q9K2+mkVHVjdtCrCtoOYEIpMLzsRtqyAWotcVmdv8Zv 4IIjxfdxpTkj9gZmUfDIe6tbN2iBCAo1HArXq1qSdof3ui8SqdWeinkd7lZMesFm dGQaAcHbmEakO5mRzljme8IBs3UY9j/zxEG1JbsHx9ua7CVwJ7lxi2SgSW6nF9k5 CX5zbrDqlqSJNtDs+KbjCbI2eK+qe4qZWHPiw4bNBn6EWf97/4Os8w7Vrrpyd2eO 1JENwjlG6WG9mbJdIWWwakZ0CeH5LnJo6dV47KZbbbB6ncavaL+VpfbTCgdOGsCc GcYUVl90/v5pPm2owx4Dg9hSfcp8fesQuq4b79NAcjF7meu5wgNdvFlfuXony+UC W2wNi0mi9lzLD0n0j0GDzWyd3r7yXmPTL4LhrQu/pIcWIljKI3GUAQZqIYbGAO3G 7hEFT8rDWg2vKRtMag4iy5FvZFqR+7TwWJAcWnHJBZ95F9NzeYIFhp9a3hxbKXqD xEnyGgzAszUycq29BApT4/4rDZQuXuOBd4lJp8tSzctLjvo7D3la+MWD6AlDkYT4 bGKN9NfRCzYr2Zq3jOByAV3d5hGgyzdJlZSqXAGtbHHdABEBAAGJAjwEGAEIACYW IQRt1uZ3AoFYRvyFJaPdLlB/e9sWaQUCXlXhMAIbDAUJCWYBgAAKCRDdLlB/e9sW aSGfD/wPeq6lGu8ocHIkO74VPioJRKRXDVLsY02xKP64p0RHUGFTOqqB3A3UV0ue tkizoUdfF5xkgJ18gbxXo8lotBq+Ita5hoYAfqJnTnucAPGovREJ+X1HfdK4pJqW KNJElBz+fC4chqksiUAuH7IMImmy0/lA+LqZagzkQJU10MvmiFZ6kn+X5Mb4izRl vAHo16eI4psApdT8Bs7mwAjgCHxS9Re46uOElB4Bx3iFPd/PEwHWnfr8x9TJZYKW fsShG31+vfBRCfGtfKGxiAkp3EEM11lzbbfMcC3lai5iJQ/FmHgoIDeIG2Ebuk4w /PYakSrpvkEYoMP31pVHDhzopVeURS2lpvQJ4CvTP5CVQtKrbuygow6GF8N/drCE hdEx22pzW02ADS9fgzrlDztIOlOvC9a+epISIaEjfrc9dWhrw6chZEoWIil2MVQR Sj0jZ8w/H7P88oHTOcFVel73ZEPg9eRUkqMnIn3DWUuqLI2SX/AtVnhdYHWTiOkq knsGofWxUSu3RZR2ZElK9hjNKdVbGDzHGAYeJihieTKIOXpCf6Ix5B32tmFpfmBV Q9YP3JLsRTxIMbXsJImand/r6fSjdmTpk2PovYPtE1HTJKaVHeagQdsrWw5LaJv0 ZWuwJm0y0WJXcAEjwOHhBs0nvq2CXuZi2ZTPtY+DbsSFWhaN7g== =Ysgx -----END PGP PUBLIC KEY BLOCK----- PK��r�\͎� ,��,��php-encryption/dist/Makefilenu��[��# This builds defuse-crypto.phar. To run this Makefile, `box` and `composer` # must be installed and in your $PATH. Run it from inside the dist/ directory. box := $(shell which box) composer := $(shell which composer) gitcommit := $(shell git rev-parse HEAD) .PHONY: all all: build-phar .PHONY: sign-phar sign-phar: gpg -u DD2E507F7BDB1669 --armor --output defuse-crypto.phar.sig --detach-sig defuse-crypto.phar # ensure we run in clean tree. export git tree and run there. .PHONY: build-phar build-phar: @echo "Creating .phar from revision $(shell git rev-parse HEAD)." rm -rf worktree install -d worktree (cd $(CURDIR)/..; git archive HEAD) \| tar -x -C worktree $(MAKE) -f $(CURDIR)/Makefile -C worktree defuse-crypto.phar mv worktree/.phar . rm -rf worktree .PHONY: clean clean: rm -vf defuse-crypto.phar defuse-crypto.phar.sig # Inside workdir/: defuse-crypto.phar: dist/box.json composer.lock cp dist/box.json . php $(box) compile -c box.json -v composer.lock: $(composer) config autoloader-suffix $(gitcommit) $(composer) install --no-dev PK��r�\��t��php-encryption/dist/box.jsonnu��[��{ "chmod": "0755", "finder": [ { "in": "src", "name": ".php" }, { "in": "vendor/composer", "name": ".php" }, { "in": "vendor/paragonie", "name": ".php", "exclude": "other" } ], "main": "vendor/autoload.php", "output": "defuse-crypto.phar", "shebang": false, "stub": true } PK��r�\��6��6����php-encryption/dist/signingkey-new.asc.signu��[��3��!/��&Xk�=S8^�U�)8^�� 8^�U�)8��WtY�j��X�c��H��S�w!�p�5C\|��w�ӨT֖x��] :E��Y�g��BP��"Z�7�w\|k�!�� /�T�v��л�S$I2�(GO�]��{�ϱ��^L��\j�F�;35�h>\|�m�Ϝ�h��6��i�GaT"Z?�^��o�\|f�]�:e��T�j��P^��&hK�G��T�\��t�A=ީ�Ǫ$��8ۣE��R�� @��=[�a��;Lھ��.w(��w��^\d��Q�e�~y3/�� m�]��`ڸ֩�FNd�Z��[A��z:Ɗ�� s�^f��^�X�� A��#\|`sWB�:��9P!.��JQ�uO�.��&�ߕ��5�� o�/�l �X�%?�Fj68؜��Sg@�i�?L�V�O��4�V�ܑN�ƹ�ŕ��2��u��Tá<f_��n��1��A��T�I�GǙ/ `WW�'X��PK��r�\c��$��php-encryption/src/KeyOrPassword.phpnu��[��PK��r�\��s��s��-��php-encryption/src/KeyProtectedByPassword.phpnu��[��PK��r�\Oܯh=��h=��$��php-encryption/src/Core.phpnu��[��PK��r�\Kt(� 9�� 9��b��php-encryption/src/Crypto.phpnu��[��PK��r�\O��$��$��php-encryption/src/Encoding.phpnu��[��PK��r�\!��"��php-encryption/src/DerivedKeys.phpnu��[��PK��r�\� �(� �� #��3��php-encryption/src/RuntimeTests.phpnu��[��PK��r�\q(P ��P ��=��php-encryption/src/Key.phpnu��[��PK��r�\��X��X��0��php-encryption/src/Exception/CryptoException.phpnu��[��PK��r�\d�+M��F��php-encryption/src/Exception/WrongKeyOrModifiedCiphertextException.phpnu��[��PK��r�\ ��=��php-encryption/src/Exception/EnvironmentIsBrokenException.phpnu��[��PK��r�\"i&�r��r��,��php-encryption/src/Exception/IOException.phpnu��[��PK��r�\=��y��y��3��O��php-encryption/src/Exception/BadFormatException.phpnu��[��PK��r�\�?��k��k��+��php-encryption/src/File.phpnu��[��PK��r�\J�9ї��_�php-encryption/LICENSEnu��[��PK��r�\��"����&��c�php-encryption/bin/generate-defuse-keynu��[��PK��r�\� r� �� "��ve�php-encryption/dist/signingkey.ascnu��[��PK��r�\�W��-��q�php-encryption/dist/phar-testing-autoload.phpnu��[��PK��r�\"R�4��&��r�php-encryption/dist/signingkey-new.ascnu��[��PK��r�\͎� ,��,��php-encryption/dist/Makefilenu��[��PK��r�\��t��`��php-encryption/dist/box.jsonnu��[��PK��r�\��6��6����`��php-encryption/dist/signingkey-new.asc.signu��[��PK��

| ver. 1.4 | Github | . | PHP 8.3.23 | Generation time: 0 | proxy | phpinfo | Settings