Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add RSA MGF1 signature types #200

Open
wants to merge 4 commits into
base: master
Choose a base branch
from
Open

Add RSA MGF1 signature types #200

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
c2e5a14
Add RSA MGF1 signature types
liamdennehy Sep 9, 2019
9685ba3
Travis: Pin PHP < 5.6 on dist:trusty
liamdennehy Sep 16, 2019
4857aeb
Travis: Install compatible phpunit from composer for php 7.{0,1}
liamdennehy Sep 16, 2019
fe4c990
Travis: Script readability for conditional testing
liamdennehy Sep 16, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 26 additions & 4 deletions .travis.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,20 +6,42 @@ matrix:
fast_finish: true
include:
- php: 5.4
dist: trusty
- php: 5.5
dist: trusty
- php: 5.6
env:
- EXECUTE_COVERAGE=true
- php: 7.0.27
env:
- LOCAL_PHPUNIT=false
- php: 7.1
env:
- LOCAL_PHPUNIT=false
- php: 7.2
- php: 7.3
allow_failures:
- php: hhvm

script:
- if [[ $EXECUTE_COVERAGE == 'true' ]]; then phpunit --coverage-clover clover.xml tests; fi
- if [[ $EXECUTE_COVERAGE != 'true' ]]; then phpunit tests; fi

- |
if [[ $LOCAL_PHPUNIT == 'false' ]]; then
composer require --dev phpunit/phpunit
export phpunitbin="./vendor/bin/phpunit"
else
export phpunitbin="phpunit"
fi
- |
if [[ $EXECUTE_COVERAGE == 'true' ]]; then
export phpunitparms="--coverage-clover clover.xml tests"
else
export phpunitparms="tests"
fi
- echo $phpunitbin $phpunitparms && $phpunitbin $phpunitparms

after_success:
- if [[ $EXECUTE_COVERAGE == 'true' ]]; then bash <(curl -s https://codecov.io/bash); fi

cache:
directories:
- $HOME/.composer/cache/files
58 changes: 55 additions & 3 deletions src/XMLSecurityKey.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,6 +57,10 @@ class XMLSecurityKey
const RSA_SHA256 = 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256';
const RSA_SHA384 = 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha384';
const RSA_SHA512 = 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha512';
const SHA1_RSA_MGF1 = 'http://www.w3.org/2007/05/xmldsig-more#sha1-rsa-MGF1';
const SHA256_RSA_MGF1 = 'http://www.w3.org/2007/05/xmldsig-more#sha256-rsa-MGF1';
const SHA384_RSA_MGF1 = 'http://www.w3.org/2007/05/xmldsig-more#sha384-rsa-MGF1';
const SHA512_RSA_MGF1 = 'http://www.w3.org/2007/05/xmldsig-more#sha512-rsa-MGF1';
const HMAC_SHA1 = 'http://www.w3.org/2000/09/xmldsig#hmac-sha1';

/** @var array */
Expand Down Expand Up @@ -212,6 +216,54 @@ public function __construct($type, $params=null)
}
}
throw new Exception('Certificate "type" (private/public) must be passed via parameters');
case (self::SHA1_RSA_MGF1):
$this->cryptParams['library'] = 'openssl';
$this->cryptParams['padding'] = OPENSSL_PKCS1_OAEP_PADDING;
$this->cryptParams['method'] = 'http://www.w3.org/2007/05/xmldsig-more#sha1-rsa-MGF1';
$this->cryptParams['digest'] = 'SHA1';
if (is_array($params) && ! empty($params['type'])) {
if ($params['type'] == 'public' || $params['type'] == 'private') {
$this->cryptParams['type'] = $params['type'];
break;
}
}
throw new Exception('Certificate "type" (private/public) must be passed via parameters');
case (self::SHA256_RSA_MGF1):
$this->cryptParams['library'] = 'openssl';
$this->cryptParams['padding'] = OPENSSL_PKCS1_OAEP_PADDING;
$this->cryptParams['method'] = 'http://www.w3.org/2007/05/xmldsig-more#sha256-rsa-MGF1';
$this->cryptParams['digest'] = 'SHA256';
if (is_array($params) && ! empty($params['type'])) {
if ($params['type'] == 'public' || $params['type'] == 'private') {
$this->cryptParams['type'] = $params['type'];
break;
}
}
throw new Exception('Certificate "type" (private/public) must be passed via parameters');
case (self::SHA384_RSA_MGF1):
$this->cryptParams['library'] = 'openssl';
$this->cryptParams['padding'] = OPENSSL_PKCS1_OAEP_PADDING;
$this->cryptParams['method'] = 'http://www.w3.org/2007/05/xmldsig-more#sha384-rsa-MGF1';
$this->cryptParams['digest'] = 'SHA384';
if (is_array($params) && ! empty($params['type'])) {
if ($params['type'] == 'public' || $params['type'] == 'private') {
$this->cryptParams['type'] = $params['type'];
break;
}
}
throw new Exception('Certificate "type" (private/public) must be passed via parameters');
case (self::SHA512_RSA_MGF1):
$this->cryptParams['library'] = 'openssl';
$this->cryptParams['padding'] = OPENSSL_PKCS1_OAEP_PADDING;
$this->cryptParams['method'] = 'http://www.w3.org/2007/05/xmldsig-more#sha512-rsa-MGF1';
$this->cryptParams['digest'] = 'SHA512';
if (is_array($params) && ! empty($params['type'])) {
if ($params['type'] == 'public' || $params['type'] == 'private') {
$this->cryptParams['type'] = $params['type'];
break;
}
}
throw new Exception('Certificate "type" (private/public) must be passed via parameters');
case (self::HMAC_SHA1):
$this->cryptParams['library'] = $type;
$this->cryptParams['method'] = 'http://www.w3.org/2000/09/xmldsig#hmac-sha1';
Expand Down Expand Up @@ -250,9 +302,9 @@ public function generateSessionKey()
throw new Exception('Unknown key size for type "' . $this->type . '".');
}
$keysize = $this->cryptParams['keysize'];

$key = openssl_random_pseudo_bytes($keysize);

if ($this->type === self::TRIPLEDES_CBC) {
/* Make sure that the generated key has the proper parity bits set.
* Mcrypt doesn't care about the parity bits, but others may care.
Expand All @@ -267,7 +319,7 @@ public function generateSessionKey()
$key[$i] = chr($byte);
}
}

$this->key = $key;
return $key;
}
Expand Down