<?php /** * Akeeba WebPush * * An abstraction layer for easier implementation of WebPush in Joomla components. * * @copyright (c) 2022 Akeeba Ltd * @license GNU GPL v3 or later; see LICENSE.txt * * This program is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program. If not, see <https://www.gnu.org/licenses/>. */ declare(strict_types=1); namespace Akeeba\WebPush\WebPush; use Akeeba\WebPush\ECC\Curve; use Akeeba\WebPush\ECC\Point; use Akeeba\WebPush\ECC\PrivateKey; use Base64Url\Base64Url; use Brick\Math\BigInteger; use function mb_substr; use function chr; use function hex2bin; use function is_array; use function openssl_encrypt; use function pack; use function str_pad; use function unpack; use const false; use const OPENSSL_RAW_DATA; use const STR_PAD_LEFT; /** * This class is a derivative work based on the WebPush library by Louis Lagrange. It has been modified to only use * dependencies shipped with Joomla itself and must not be confused with the original work. * * You can find the original code at https://github.com/web-push-libs * * The original code came with the following copyright notice: * * ===================================================================================================================== * * This file is part of the WebPush library. * * (c) Louis Lagrange <lagrange.louis@gmail.com> * * For the full copyright and license information, please view the LICENSE-LAGRANGE.txt * file that was distributed with this source code. * * ===================================================================================================================== */ class Encryption { public const MAX_PAYLOAD_LENGTH = 4078; public const MAX_COMPATIBILITY_PAYLOAD_LENGTH = 3052; /** * @param string $payload With padding * @param string $userPublicKey Base 64 encoded (MIME or URL-safe) * @param string $userAuthToken Base 64 encoded (MIME or URL-safe) * * @throws \ErrorException */ public static function encrypt(string $payload, string $userPublicKey, string $userAuthToken, string $contentEncoding): array { $localKeyData = self::createLocalKeyObjectUsingOpenSSL(); $salt = random_bytes(16); $userPublicKey = Base64Url::decode($userPublicKey); $userAuthToken = Base64Url::decode($userAuthToken); // get local key pair $localPublicKey = hex2bin(Utils::serializePublicKeyFromData($localKeyData)); if (!$localPublicKey) { throw new \ErrorException('Failed to convert local public key from hexadecimal to binary'); } // get user public key object [$userPublicKeyObjectX, $userPublicKeyObjectY] = Utils::unserializePublicKey($userPublicKey); $userKeyData = [ 'x' => $userPublicKeyObjectX, 'y' => $userPublicKeyObjectY, ]; // get shared secret from user public key and local private key $sharedSecret = Encryption::calculateAgreementKey($localKeyData, $userKeyData); $sharedSecret = str_pad($sharedSecret, 32, chr(0), STR_PAD_LEFT); // section 4.3 $ikm = Encryption::getIKM($userAuthToken, $userPublicKey, $localPublicKey, $sharedSecret, $contentEncoding); // section 4.2 $context = Encryption::createContext($userPublicKey, $localPublicKey, $contentEncoding); // derive the Content Encryption Key $contentEncryptionKeyInfo = Encryption::createInfo($contentEncoding, $context, $contentEncoding); $contentEncryptionKey = Encryption::hkdf($salt, $ikm, $contentEncryptionKeyInfo, 16); // section 3.3, derive the nonce $nonceInfo = Encryption::createInfo('nonce', $context, $contentEncoding); $nonce = Encryption::hkdf($salt, $ikm, $nonceInfo, 12); // encrypt // "The additional data passed to each invocation of AEAD_AES_128_GCM is a zero-length octet sequence." $tag = ''; $encryptedText = openssl_encrypt($payload, 'aes-128-gcm', $contentEncryptionKey, OPENSSL_RAW_DATA, $nonce, $tag); // return values in url safe base64 return [ 'localPublicKey' => $localPublicKey, 'salt' => $salt, 'cipherText' => $encryptedText . $tag, ]; } public static function getContentCodingHeader(string $salt, string $localPublicKey, string $contentEncoding): string { if ($contentEncoding === "aes128gcm") { return $salt . pack('N*', 4096) . pack('C*', Utils::safeStrlen($localPublicKey)) . $localPublicKey; } return ""; } /** * @return string padded payload (plaintext) * @throws \ErrorException */ public static function padPayload(string $payload, int $maxLengthToPad, string $contentEncoding): string { $payloadLen = Utils::safeStrlen($payload); $padLen = $maxLengthToPad ? $maxLengthToPad - $payloadLen : 0; if ($contentEncoding === "aesgcm") { return pack('n*', $padLen) . str_pad($payload, $padLen + $payloadLen, chr(0), STR_PAD_LEFT); } elseif ($contentEncoding === "aes128gcm") { return str_pad($payload . chr(2), $padLen + $payloadLen, chr(0), STR_PAD_RIGHT); } else { throw new \ErrorException("This content encoding is not supported"); } } private static function addNullPadding(string $data): string { return str_pad($data, 32, chr(0), STR_PAD_LEFT); } private static function calculateAgreementKey(array $private_key, array $public_key): string { if (function_exists('openssl_pkey_derive')) { try { $publicPem = self::convertPublicKeyToPEM($public_key); $private_key = array_map([Base64Url::class, 'encode'], $private_key); $privatePem = self::convertPrivateKeyToPEM($private_key); $result = openssl_pkey_derive($publicPem, $privatePem, 256); if ($result === false) { throw new \Exception('Unable to compute the agreement key'); } return $result; } catch (\Throwable $throwable) { //Does nothing. Will fallback to the pure PHP function } } $curve = self::curve256(); $rec_x = self::convertBase64ToBigInteger($public_key['x']); $rec_y = self::convertBase64ToBigInteger($public_key['y']); $sen_d = self::convertBase64ToBigInteger($private_key['d']); $priv_key = PrivateKey::create($sen_d); $pub_key = $curve->getPublicKeyFrom($rec_x, $rec_y); return hex2bin(str_pad($curve->mul($pub_key->getPoint(), $priv_key->getSecret())->getX()->toBase(16), 64, '0', STR_PAD_LEFT)); } /** * @throws \ErrorException */ private static function convertBase64ToBigInteger(string $value): BigInteger { try { $value = unpack('H*', Base64Url::decode($value)); } catch (\Exception $e) { $value = unpack('H*', $value); } if ($value === false) { throw new \ErrorException('Unable to unpack hex value from string'); } return BigInteger::fromBase($value[1], 16); } /** * @throws \ErrorException */ private static function convertBase64ToGMP(string $value): \GMP { $value = unpack('H*', Base64Url::decode($value)); if ($value === false) { throw new \ErrorException('Unable to unpack hex value from string'); } return gmp_init($value[1], 16); } /** * Creates a context for deriving encryption parameters. * See section 4.2 of * {@link https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-00} * From {@link https://github.com/GoogleChrome/push-encryption-node/blob/master/src/encrypt.js}. * * @param string $clientPublicKey The client's public key * @param string $serverPublicKey Our public key * * @throws \ErrorException */ private static function createContext(string $clientPublicKey, string $serverPublicKey, string $contentEncoding): ?string { if ($contentEncoding === "aes128gcm") { return null; } if (Utils::safeStrlen($clientPublicKey) !== 65) { throw new \ErrorException('Invalid client public key length'); } // This one should never happen, because it's our code that generates the key if (Utils::safeStrlen($serverPublicKey) !== 65) { throw new \ErrorException('Invalid server public key length'); } $len = chr(0) . 'A'; // 65 as Uint16BE return chr(0) . $len . $clientPublicKey . $len . $serverPublicKey; } /** * Returns an info record. See sections 3.2 and 3.3 of * {@link https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-00} * From {@link https://github.com/GoogleChrome/push-encryption-node/blob/master/src/encrypt.js}. * * @param string $type The type of the info record * @param string|null $context The context for the record * * @throws \ErrorException */ private static function createInfo(string $type, ?string $context, string $contentEncoding): string { if ($contentEncoding === "aesgcm") { if (!$context) { throw new \ErrorException('Context must exist'); } if (Utils::safeStrlen($context) !== 135) { throw new \ErrorException('Context argument has invalid size'); } return 'Content-Encoding: ' . $type . chr(0) . 'P-256' . $context; } elseif ($contentEncoding === "aes128gcm") { return 'Content-Encoding: ' . $type . chr(0); } throw new \ErrorException('This content encoding is not supported.'); } private static function createLocalKeyObjectUsingOpenSSL(): array { $keyResource = openssl_pkey_new([ 'curve_name' => 'prime256v1', 'private_key_type' => OPENSSL_KEYTYPE_EC, ]); if (!$keyResource) { throw new \RuntimeException('Unable to create the key'); } $details = openssl_pkey_get_details($keyResource); if (PHP_MAJOR_VERSION < 8) { openssl_pkey_free($keyResource); } if (!$details) { throw new \RuntimeException('Unable to get the key details'); } return [ 'x' => self::addNullPadding($details['ec']['x']), 'y' => self::addNullPadding($details['ec']['y']), 'd' => self::addNullPadding($details['ec']['d']), ]; } /** * @throws \ErrorException */ private static function getIKM(string $userAuthToken, string $userPublicKey, string $localPublicKey, string $sharedSecret, string $contentEncoding): string { if (!empty($userAuthToken)) { if ($contentEncoding === "aesgcm") { $info = 'Content-Encoding: auth' . chr(0); } elseif ($contentEncoding === "aes128gcm") { $info = "WebPush: info" . chr(0) . $userPublicKey . $localPublicKey; } else { throw new \ErrorException("This content encoding is not supported"); } return self::hkdf($userAuthToken, $sharedSecret, $info, 32); } return $sharedSecret; } /** * HMAC-based Extract-and-Expand Key Derivation Function (HKDF). * * This is used to derive a secure encryption key from a mostly-secure shared * secret. * * This is a partial implementation of HKDF tailored to our specific purposes. * In particular, for us the value of N will always be 1, and thus T always * equals HMAC-Hash(PRK, info | 0x01). * * See {@link https://www.rfc-editor.org/rfc/rfc5869.txt} * From {@link https://github.com/GoogleChrome/push-encryption-node/blob/master/src/encrypt.js} * * @param string $salt A non-secret random value * @param string $ikm Input keying material * @param string $info Application-specific context * @param int $length The length (in bytes) of the required output key */ private static function hkdf(string $salt, string $ikm, string $info, int $length): string { // extract $prk = hash_hmac('sha256', $ikm, $salt, true); // expand return mb_substr(hash_hmac('sha256', $info . chr(1), $prk, true), 0, $length, '8bit'); } /** * @throws \InvalidArgumentException if the curve is not supported */ public static function convertPublicKeyToPEM(array $keyData): string { $der = pack( 'H*', '3059' // SEQUENCE, length 89 .'3013' // SEQUENCE, length 19 .'0607' // OID, length 7 .'2a8648ce3d0201' // 1.2.840.10045.2.1 = EC Public Key .'0608' // OID, length 8 .'2a8648ce3d030107' // 1.2.840.10045.3.1.7 = P-256 Curve .'0342' // BIT STRING, length 66 .'00' // prepend with NUL - pubkey will follow ); $der .= "\04" . str_pad($keyData['x'], 32, "\0", STR_PAD_LEFT) . str_pad($keyData['y'], 32, "\0", STR_PAD_LEFT); $pem = '-----BEGIN PUBLIC KEY-----'.PHP_EOL; $pem .= chunk_split(base64_encode($der), 64, PHP_EOL); $pem .= '-----END PUBLIC KEY-----'.PHP_EOL; return $pem; } /** * @throws \InvalidArgumentException if the curve is not supported */ public static function convertPrivateKeyToPEM(array $keyData): string { $d = unpack('H*', str_pad(Base64Url::decode($keyData['d']), 32, "\0", STR_PAD_LEFT)); if (!is_array($d) || !isset($d[1])) { throw new \InvalidArgumentException('Unable to get the private key'); } $der = pack( 'H*', '3077' // SEQUENCE, length 87+length($d)=32 . '020101' // INTEGER, 1 . '0420' // OCTET STRING, length($d) = 32 . $d[1] . 'a00a' // TAGGED OBJECT #0, length 10 . '0608' // OID, length 8 . '2a8648ce3d030107' // 1.3.132.0.34 = P-256 Curve . 'a144' // TAGGED OBJECT #1, length 68 . '0342' // BIT STRING, length 66 . '00' // prepend with NUL - pubkey will follow ); $der .= "\04" . str_pad(Base64Url::decode($keyData['x']), 32, "\0", STR_PAD_LEFT) . str_pad(Base64Url::decode($keyData['y']), 32, "\0", STR_PAD_LEFT); $pem = '-----BEGIN EC PRIVATE KEY-----'.PHP_EOL; $pem .= chunk_split(base64_encode($der), 64, PHP_EOL); $pem .= '-----END EC PRIVATE KEY-----'.PHP_EOL; return $pem; } /** * Returns an NIST P-256 curve. */ private static function curve256(): Curve { $p = BigInteger::fromBase('ffffffff00000001000000000000000000000000ffffffffffffffffffffffff', 16); $a = BigInteger::fromBase('ffffffff00000001000000000000000000000000fffffffffffffffffffffffc', 16); $b = BigInteger::fromBase('5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b', 16); $x = BigInteger::fromBase('6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296', 16); $y = BigInteger::fromBase('4fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5', 16); $n = BigInteger::fromBase('ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551', 16); $generator = Point::create($x, $y, $n); return new Curve(256, $p, $a, $b, $generator); } }
