class.ilBcryptPasswordEncoder.php

Go to the documentation of this file.

<?php
/* Copyright (c) 1998-2014 ILIAS open source, Extended GPL, see docs/LICENSE */

require_once 'Services/Password/classes/class.ilBasePasswordEncoder.php';

class ilBcryptPasswordEncoder extends ilBasePasswordEncoder
{
        const MIN_SALT_SIZE         = 16;

        const SALT_STORAGE_FILENAME = 'pwsalt.txt';

        protected $client_salt = null;

        protected $costs = '08';

        protected $is_security_flaw_ignored = false;

        protected $backward_compatibility = false;

        public function __construct(array $config = array())
        {
                if(!empty($config))
                {
                        foreach($config as $key => $value)
                        {
                                switch(strtolower($key))
                                {
                                        case 'cost':
                                                $this->setCosts($value);
                                                break;

                                        case 'ignore_security_flaw':
                                                $this->setIsSecurityFlawIgnored($value);
                                                break;
                                }
                        }
                }
                
                $this->init();
        }

        protected function init()
        {
                $this->readClientSalt();
        }

        protected function isBcryptSupported()
        {
                return PHP_VERSION_ID >= 50307;
        }

        public function isBackwardCompatibilityEnabled()
        {
                return (bool)$this->backward_compatibility;
        }

        public function setBackwardCompatibility($backward_compatibility)
        {
                $this->backward_compatibility = (bool)$backward_compatibility;
        }

        public function isSecurityFlawIgnored()
        {
                return (bool)$this->is_security_flaw_ignored;
        }

        public function setIsSecurityFlawIgnored($is_security_flaw_ignored)
        {
                $this->is_security_flaw_ignored = (bool)$is_security_flaw_ignored;
        }

        public function getClientSalt()
        {
                return $this->client_salt;
        }

        public function setClientSalt($client_salt)
        {
                $this->client_salt = $client_salt;
        }

        public function getCosts()
        {
                return $this->costs;
        }

        public function setCosts($costs)
        {
                if(!empty($costs))
                {
                        $costs = (int)$costs;
                        if($costs < 4 || $costs > 31)
                        {
                                require_once 'Services/Password/exceptions/class.ilPasswordException.php';
                                throw new ilPasswordException('The costs parameter of bcrypt must be in range 04-31');
                        }
                        $this->costs = sprintf('%1$02d', $costs);
                }
        }

        public function encodePassword($raw, $salt)
        {
                if(!$this->getClientSalt())
                {
                        require_once 'Services/Password/exceptions/class.ilPasswordException.php';
                        throw new ilPasswordException('Missing client salt.');
                }

                if($this->isPasswordTooLong($raw))
                {
                        require_once 'Services/Password/exceptions/class.ilPasswordException.php';
                        throw new ilPasswordException('Invalid password.');
                }
                
                return $this->encode($raw, $salt);
        }

        public function isPasswordValid($encoded, $raw, $salt)
        {
                if(!$this->getClientSalt())
                {
                        require_once 'Services/Password/exceptions/class.ilPasswordException.php';
                        throw new ilPasswordException('Missing client salt.');
                }

                return !$this->isPasswordTooLong($raw)  && $this->check($encoded, $raw, $salt);
        }

        public function getName()
        {
                return 'bcrypt';
        }

        public function requiresSalt()
        {
                return true;
        }

        protected function encode($raw, $user_secret)
        {
                $client_secret   = $this->getClientSalt();
                $hashed_password = hash_hmac('whirlpool', str_pad($raw, strlen($raw) * 4, sha1($user_secret), STR_PAD_BOTH), $client_secret, true);
                $salt            = substr(str_shuffle(str_repeat('./0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ', 22)), 0, 22);

                if($this->isBcryptSupported() && !$this->isBackwardCompatibilityEnabled())
                {
                        $prefix = '$2y$';
                }
                else
                {
                        $prefix = '$2a$';
                        // check if the password contains 8-bit character
                        if(!$this->isSecurityFlawIgnored() && preg_match('/[\x80-\xFF]/', $raw))
                        {
                                require_once 'Services/Password/exceptions/class.ilPasswordException.php';
                                throw new ilPasswordException(
                                        'The bcrypt implementation used by PHP can contain a security flaw ' .
                                        'using passwords with 8-bit characters. ' .
                                        'We suggest to upgrade to PHP 5.3.7+ or use passwords with only 7-bit characters.'
                                );
                        }
                }

                $salted_password = crypt($hashed_password, $prefix . $this->getCosts() . '$' . $salt);
                if(strlen($salted_password) <= 13)
                {
                        require_once 'Services/Password/exceptions/class.ilPasswordException.php';
                        throw new ilPasswordException('Error during the bcrypt generation');
                }

                return $salted_password;
        }

        protected function check($encoded, $raw, $salt)
        {
                $hashed_password  = hash_hmac('whirlpool', str_pad($raw, strlen($raw) * 4, sha1($salt), STR_PAD_BOTH), $this->getClientSalt(), true);
                return crypt($hashed_password, substr($encoded, 0, 30)) == $encoded;
        }

        public function getClientSaltLocation()
        {
                return ilUtil::getDataDir() . '/' . self::SALT_STORAGE_FILENAME;
        }

        private function readClientSalt()
        {
                if(is_file($this->getClientSaltLocation()) && is_readable($this->getClientSaltLocation()))
                {
                        $contents = file_get_contents($this->getClientSaltLocation());
                        if(strlen(trim($contents)))
                        {
                                $this->setClientSalt($contents);
                        }
                }
                else
                {
                        $this->generateClientSalt();
                        $this->storeClientSalt();
                }
        }

        private function generateClientSalt()
        {
                require_once 'Services/Password/classes/class.ilPasswordUtils.php';
                $this->setClientSalt(
                        substr(str_replace('+', '.', base64_encode(ilPasswordUtils::getBytes(self::MIN_SALT_SIZE))), 0, 22)
                );
        }

        private function storeClientSalt()
        {
                $result = @file_put_contents($this->getClientSaltLocation(), $this->getClientSalt());
                if(!$result)
                {
                        require_once 'Services/Password/exceptions/class.ilPasswordException.php';
                        throw new ilPasswordException(sprintf("Could not store the client salt in: %s. Please contact an administrator.", $this->getClientSaltLocation()));
                }
        }
}