X-Git-Url: https://git.mxchange.org/?a=blobdiff_plain;f=src%2FUtil%2FCrypto.php;h=6a49626bd2e5b377911182a45195372beebd2a8f;hb=72fc89d033070a72a01fd0b3f7a91d21d7467acb;hp=2dc97836262aae120a1b0b363112af91cf97f603;hpb=1c7f4e3c6331f8ad7b1987f33a17074908ad41eb;p=friendica.git

diff --git a/src/Util/Crypto.php b/src/Util/Crypto.php
index 2dc9783626..6a49626bd2 100644
--- a/src/Util/Crypto.php
+++ b/src/Util/Crypto.php
@@ -251,6 +251,8 @@ class Crypto
 	/**
 	 * Encrypt a string with 'aes-256-cbc' cipher method.
 	 * 
+	 * Ported from Hubzilla: https://framagit.org/hubzilla/core/blob/master/include/crypto.php
+	 * 
 	 * @param string $data
 	 * @param string $key   The key used for encryption.
 	 * @param string $iv    A non-NULL Initialization Vector.
@@ -265,6 +267,8 @@ class Crypto
 	/**
 	 * Decrypt a string with 'aes-256-cbc' cipher method.
 	 * 
+	 * Ported from Hubzilla: https://framagit.org/hubzilla/core/blob/master/include/crypto.php
+	 * 
 	 * @param string $data
 	 * @param string $key   The key used for decryption.
 	 * @param string $iv    A non-NULL Initialization Vector.
@@ -279,6 +283,8 @@ class Crypto
 	/**
 	 * Encrypt a string with 'aes-256-ctr' cipher method.
 	 * 
+	 * Ported from Hubzilla: https://framagit.org/hubzilla/core/blob/master/include/crypto.php
+	 * 
 	 * @param string $data
 	 * @param string $key   The key used for encryption.
 	 * @param string $iv    A non-NULL Initialization Vector.
@@ -293,7 +299,9 @@ class Crypto
 	}
 
 	/**
-	 * Decrypt a string with 'aes-256-cbc' cipher method.
+	 * Decrypt a string with 'aes-256-ctr' cipher method.
+	 * 
+	 * Ported from Hubzilla: https://framagit.org/hubzilla/core/blob/master/include/crypto.php
 	 * 
 	 * @param string $data
 	 * @param string $key   The key used for decryption.
@@ -309,6 +317,8 @@ class Crypto
 	}
 
 	/**
+	 * 
+	 * Ported from Hubzilla: https://framagit.org/hubzilla/core/blob/master/include/crypto.php
 	 * 
 	 * @param string $data
 	 * @param string $pubkey The public key.
@@ -325,6 +335,8 @@ class Crypto
 	}
 
 	/**
+	 * 
+	 * Ported from Hubzilla: https://framagit.org/hubzilla/core/blob/master/include/crypto.php
 	 * 
 	 * @param type $data
 	 * @param type $pubkey The public key.
@@ -339,18 +351,9 @@ class Crypto
 		}
 		$fn = 'encrypt' . strtoupper($alg);
 		if (method_exists(__CLASS__, $fn)) {
-			// A bit hesitant to use openssl_random_pseudo_bytes() as we know
-			// it has been historically targeted by US agencies for 'weakening'.
-			// It is still arguably better than trying to come up with an
-			// alternative cryptographically secure random generator.
-			// There is little point in using the optional second arg to flag the
-			// assurance of security since it is meaningless if the source algorithms
-			// have been compromised. Also none of this matters if RSA has been
-			// compromised by state actors and evidence is mounting that this has
-			// already happened.
 			$result = ['encrypted' => true];
-			$key = openssl_random_pseudo_bytes(256);
-			$iv  = openssl_random_pseudo_bytes(256);
+			$key = random_bytes(256);
+			$iv  = random_bytes(256);
 			$result['data'] = base64url_encode(self::$fn($data, $key, $iv), true);
 
 			// log the offending call so we can track it down
@@ -374,6 +377,8 @@ class Crypto
 	}
 
 	/**
+	 * 
+	 * Ported from Hubzilla: https://framagit.org/hubzilla/core/blob/master/include/crypto.php
 	 * 
 	 * @param string $data
 	 * @param string $pubkey
@@ -386,10 +391,10 @@ class Crypto
 			logger('aes_encapsulate: no key. data: ' . $data);
 		}
 
-		$key = openssl_random_pseudo_bytes(32);
-		$iv  = openssl_random_pseudo_bytes(16);
+		$key = random_bytes(32);
+		$iv  = random_bytes(16);
 		$result = ['encrypted' => true];
-		$result['data'] = base64url_encode(AES256CBC_encrypt($data, $key, $iv), true);
+		$result['data'] = base64url_encode(self::encryptAES256CBC($data, $key, $iv), true);
 
 		// log the offending call so we can track it down
 		if (!openssl_public_encrypt($key, $k, $pubkey)) {
@@ -406,6 +411,8 @@ class Crypto
 	}
 
 	/**
+	 * 
+	 * Ported from Hubzilla: https://framagit.org/hubzilla/core/blob/master/include/crypto.php
 	 * 
 	 * @param string $data
 	 * @param string $prvkey  The private key used for decryption.
@@ -426,6 +433,8 @@ class Crypto
 	}
 
 	/**
+	 * 
+	 * Ported from Hubzilla: https://framagit.org/hubzilla/core/blob/master/include/crypto.php
 	 * 
 	 * @param string $data
 	 * @param string $prvkey  The private key used for decryption.
@@ -451,6 +460,8 @@ class Crypto
 	}
 
 	/**
+	 * 
+	 * Ported from Hubzilla: https://framagit.org/hubzilla/core/blob/master/include/crypto.php
 	 * 
 	 * @param array  $data
 	 * @param string $prvkey  The private key used for decryption.