Skip to content

Use a PHP implementation of openssl_seal that allows to use modern ciphers #36173

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
szaimen merged 5 commits into from
Mar 2, 2023
Merged

Use a PHP implementation of openssl_seal that allows to use modern ciphers #36173

Changes from 1 commit
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
8163843
introduce wrapped_openssl_seal() and wrapped_openssl_open() to circum…
weizenspreu Dec 29, 2022
deed639
Always wrap rc4, and throws on unknown cipher
come-nc Jan 16, 2023
bd626e3
Strong type custom openssl_seal implementation
come-nc Jan 16, 2023
7148257
Move to phpseclib implementation of RC4
come-nc Feb 21, 2023
f2912ce
Set functions as private to be able to refactor later
come-nc Feb 21, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Move to phpseclib implementation of RC4 
Signed-off-by: Côme Chilliet <[email protected]>
  • Loading branch information
@come-nc
come-nc committed Feb 21, 2023
commit 71482576ad9ab0a2231e792d4a30605651fefb02
58 changes: 16 additions & 42 deletions apps/encryption/lib/Crypto/Crypt.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,7 @@
use OCP\IL10N;
use OCP\ILogger;
use OCP\IUserSession;
use phpseclib\Crypt\RC4;

/**
* Class Crypt provides the encryption implementation of the default Nextcloud
Expand Down Expand Up @@ -758,50 +759,23 @@ public function useLegacyBase64Encoding(): bool {
}

/**
* implements RC4
*
* @param $data
* @param $secret
* @return string
* Uses phpseclib RC4 implementation
*/
public function rc4($data, $secret) {
// initialize $result
$result = "";

// initialize $state
$state = [];
for ($i = 0x00; $i <= 0xFF; $i++) {
$state[$i] = $i;
}

// mix $secret into $state
$indexA = 0x00;
$indexB = 0x00;
for ($i = 0x00; $i <= 0xFF; $i++) {
$indexB = ($indexB + ord($secret[$indexA]) + $state[$i]) % 0x100;

$tmp = $state[$i];
$state[$i] = $state[$indexB];
$state[$indexB] = $tmp;

$indexA = ($indexA + 0x01) % strlen($secret);
}

// decrypt $data with $state
$indexA = 0x00;
$indexB = 0x00;
for ($i = 0x00; $i < strlen($data); $i++) {
$indexA = ($indexA + 0x01) % 0x100;
$indexB = ($state[$indexA] + $indexB) % 0x100;
protected function rc4Decrypt(string $data, string $secret): string {
$rc4 = new RC4();
$rc4->setKey($secret);

$tmp = $state[$indexA];
$state[$indexA] = $state[$indexB];
$state[$indexB] = $tmp;
return $rc4->decrypt($data);
}

$result .= chr(ord($data[$i]) ^ $state[($state[$indexA] + $state[$indexB]) % 0x100]);
}
/**
* Uses phpseclib RC4 implementation
*/
protected function rc4Encrypt(string $data, string $secret): string {
$rc4 = new RC4();
$rc4->setKey($secret);

return $result;
return $rc4->encrypt($data);
}

/**
Expand All @@ -820,7 +794,7 @@ public function opensslOpen(string $data, string &$output, string $encrypted_key
if (openssl_private_decrypt($encrypted_key, $intermediate, $private_key, OPENSSL_PKCS1_PADDING)) {
// decrypt the file key with the intermediate key
// using our own RC4 implementation
$output = $this->rc4($data, $intermediate);
$output = $this->rc4Decrypt($data, $intermediate);
$result = (strlen($output) === strlen($data));
}
} else {
Expand Down Expand Up @@ -849,7 +823,7 @@ public function opensslSeal(string $data, string &$sealed_data, array &$encrypte
if ($strong_result) {
// encrypt the file key with the intermediate key
// using our own RC4 implementation
$sealed_data = $this->rc4($data, $intermediate);
$sealed_data = $this->rc4Encrypt($data, $intermediate);
if (strlen($sealed_data) === strlen($data)) {
// prepare the encrypted keys
$encrypted_keys = [];
Expand Down