Encryptor Class Reference

Inheritance diagram for Encryptor:

Public Member Functions
	__construct (Random $random, DeploymentConfig $deploymentConfig)
	validateCipher ($version)
	getHash ($password, $salt=false, $version=self::HASH_VERSION_LATEST)
	hash ($data, $version=self::HASH_VERSION_LATEST)
	validateHash ($password, $hash)
	isValidHash ($password, $hash)
	validateHashVersion ($hash, $validateCount=false)
	encrypt ($data)
	encryptWithFastestAvailableAlgorithm ($data)
	decrypt ($data)
	validateKey ($key)
	setNewKey ($key)
	exportKeys ()
Public Member Functions inherited from EncryptorInterface
	getHash ($password, $salt=false)
	hash ($data)

Data Fields
const	HASH_VERSION_MD5 = 0
const	HASH_VERSION_SHA256 = 1
const	HASH_VERSION_LATEST = 1
const	DEFAULT_SALT_LENGTH = 32
const	PASSWORD_HASH = 0
const	PASSWORD_SALT = 1
const	PASSWORD_VERSION = 2
const	PARAM_CRYPT_KEY = 'crypt/key'
const	CIPHER_BLOWFISH = 0
const	CIPHER_RIJNDAEL_128 = 1
const	CIPHER_RIJNDAEL_256 = 2
const	CIPHER_AEAD_CHACHA20POLY1305 = 3
const	CIPHER_LATEST = 3
const	DELIMITER = ':'

Protected Attributes
	$cipher = self::CIPHER_LATEST
	$keyVersion
	$keys = []

Detailed Description

Class Encryptor provides basic logic for hashing strings and encrypting/decrypting misc data

Definition at line 21 of file Encryptor.php.

Constructor & Destructor Documentation

__construct()

__construct	(	Random	$random,
		DeploymentConfig	$deploymentConfig
	)

Encryptor constructor.

Parameters

Random	$random
DeploymentConfig	$deploymentConfig

Definition at line 123 of file Encryptor.php.

      {
        $this->random = $random;

        // load all possible keys
        $this->keys = preg_split('/\s+/s', trim((string)$deploymentConfig->get(self::PARAM_CRYPT_KEY)));
        $this->keyVersion = count($this->keys) - 1;
    }

Member Function Documentation

decrypt()

decrypt

(

$data

)

Look for key and crypt versions in encrypted data before decrypting

Unsupported/unspecified key version silently fallback to the oldest we have Unsupported cipher versions eventually throw exception Unspecified cipher version fallback to the oldest we support

Parameters

string

$data

Returns

string

Exceptions

Implements EncryptorInterface.

Definition at line 319 of file Encryptor.php.

    {
        if ($data) {
            $parts = explode(':', $data, 4);
            $partsCount = count($parts);

            $initVector = null;
            // specified key, specified crypt, specified iv
            if (4 === $partsCount) {
                list($keyVersion, $cryptVersion, $iv, $data) = $parts;
                $initVector = $iv ? $iv : null;
                $keyVersion = (int)$keyVersion;
                $cryptVersion = self::CIPHER_RIJNDAEL_256;
                // specified key, specified crypt
            } elseif (3 === $partsCount) {
                list($keyVersion, $cryptVersion, $data) = $parts;
                $keyVersion = (int)$keyVersion;
                $cryptVersion = (int)$cryptVersion;
                // no key version = oldest key, specified crypt
            } elseif (2 === $partsCount) {
                list($cryptVersion, $data) = $parts;
                $keyVersion = 0;
                $cryptVersion = (int)$cryptVersion;
                // no key version = oldest key, no crypt version = oldest crypt
            } elseif (1 === $partsCount) {
                $keyVersion = 0;
                $cryptVersion = self::CIPHER_BLOWFISH;
                // not supported format
            } else {
                return '';
            }
            // no key for decryption
            if (!isset($this->keys[$keyVersion])) {
                return '';
            }
            $crypt = $this->getCrypt($this->keys[$keyVersion], $cryptVersion, $initVector);
            if (null === $crypt) {
                return '';
            }
            return trim($crypt->decrypt(base64_decode((string)$data)));
        }
        return '';
    }

encrypt()

encrypt

(

$data

)

Prepend key and cipher versions to encrypted data after encrypting

Parameters

string

$data

Returns

string

Implements EncryptorInterface.

Definition at line 283 of file Encryptor.php.

    {
        $crypt = new SodiumChachaIetf($this->keys[$this->keyVersion]);

        return $this->keyVersion .
            ':' . self::CIPHER_AEAD_CHACHA20POLY1305 .
            ':' . base64_encode($crypt->encrypt($data));
    }

encryptWithFastestAvailableAlgorithm()

encryptWithFastestAvailableAlgorithm

(

$data

)

Encrypt data using the fastest available algorithm

Parameters

string

$data

Returns

string

Definition at line 298 of file Encryptor.php.

    {
        $crypt = $this->getCrypt();
        if (null === $crypt) {
            return $data;
        }
        return $this->keyVersion .
            ':' . $this->getCipherVersion() .
            ':' . base64_encode($crypt->encrypt($data));
    }

exportKeys()

exportKeys

(

)

Export current keys as string

Returns

string

Definition at line 396 of file Encryptor.php.

    {
        return implode("\n", $this->keys);
    }

getHash()

getHash	(		$password,
			$salt = false,
			$version = self::HASH_VERSION_LATEST
	)

Definition at line 162 of file Encryptor.php.

    {
        if ($salt === false) {
            return $this->hash($password, $version);
        }
        if ($salt === true) {
            $salt = self::DEFAULT_SALT_LENGTH;
        }
        if (is_integer($salt)) {
            $salt = $this->random->getRandomString($salt);
        }

        return implode(
            self::DELIMITER,
            [
                $this->hash($salt . $password, $version),
                $salt,
                $version
            ]
        );
    }

hash()

array map of password hash	(		$data,
			$version = self::HASH_VERSION_LATEST
	)

Definition at line 187 of file Encryptor.php.

    {
        return hash($this->hashVersionMap[$version], (string)$data);
    }

isValidHash()

isValidHash	(		$password,
			$hash
	)

Validate hash against hashing method (with or without salt)

Parameters

string	$password
string	$hash

Returns

bool

Exceptions

Implements EncryptorInterface.

Definition at line 203 of file Encryptor.php.

    {
        $this->explodePasswordHash($hash);

        foreach ($this->getPasswordVersion() as $hashVersion) {
            $password = $this->hash($this->getPasswordSalt() . $password, $hashVersion);
        }

        return Security::compareStrings(
            $password,
            $this->getPasswordHash()
        );
    }

setNewKey()

setNewKey

(

$key

)

Attempt to append new key & version

Parameters

string

$key

Returns

$this

Exceptions

Definition at line 383 of file Encryptor.php.

    {
        $this->validateKey($key);
        $this->keys[] = $key;
        $this->keyVersion += 1;
        return $this;
    }

validateCipher()

validateCipher

(

$version

)

Check whether specified cipher version is supported

Returns matched supported version or throws exception

Parameters

int

$version

Returns

int

Exceptions

Definition at line 143 of file Encryptor.php.

    {
        $types = [
            self::CIPHER_BLOWFISH,
            self::CIPHER_RIJNDAEL_128,
            self::CIPHER_RIJNDAEL_256,
            self::CIPHER_AEAD_CHACHA20POLY1305,
        ];

        $version = (int)$version;
        if (!in_array($version, $types, true)) {
            throw new \Exception((string)new \Magento\Framework\Phrase('Not supported cipher version'));
        }
        return $version;
    }

validateHash()

validateHash	(		$password,
			$hash
	)

Validate hash against hashing method (with or without salt)

Parameters

string	$password
string	$hash

Returns

bool

Exceptions

Implements EncryptorInterface.

Definition at line 195 of file Encryptor.php.

    {
        return $this->isValidHash($password, $hash);
    }

validateHashVersion()

validateHashVersion	(		$hash,
			$validateCount = false
	)

Validate hashing algorithm version

Parameters

string	$hash
bool	$validateCount

Returns

bool

Implements EncryptorInterface.

Definition at line 220 of file Encryptor.php.

    {
        $this->explodePasswordHash($hash);
        $hashVersions = $this->getPasswordVersion();

        return $validateCount
            ? end($hashVersions) === self::HASH_VERSION_LATEST && count($hashVersions) === 1
            : end($hashVersions) === self::HASH_VERSION_LATEST;
    }

validateKey()

validateKey

(

$key

)

Validate key contains only allowed characters

Parameters

string | null

$key

NULL value means usage of the default key specified on constructor

Exceptions

Implements EncryptorInterface.

Definition at line 369 of file Encryptor.php.

    {
        if (preg_match('/\s/s', $key)) {
            throw new \Exception((string)new \Magento\Framework\Phrase('The encryption key format is invalid.'));
        }
    }

Field Documentation

$cipher

$cipher = self::CIPHER_LATEST

protected

Definition at line 97 of file Encryptor.php.

$keys

$keys = []

protected

Definition at line 111 of file Encryptor.php.

$keyVersion

$keyVersion

protected

Definition at line 104 of file Encryptor.php.

CIPHER_AEAD_CHACHA20POLY1305

const CIPHER_AEAD_CHACHA20POLY1305 = 3

Definition at line 65 of file Encryptor.php.

CIPHER_BLOWFISH

const CIPHER_BLOWFISH = 0

#+ Cipher versions

Definition at line 59 of file Encryptor.php.

CIPHER_LATEST

const CIPHER_LATEST = 3

Definition at line 67 of file Encryptor.php.

CIPHER_RIJNDAEL_128

const CIPHER_RIJNDAEL_128 = 1

Definition at line 61 of file Encryptor.php.

CIPHER_RIJNDAEL_256

const CIPHER_RIJNDAEL_256 = 2

Definition at line 63 of file Encryptor.php.

DEFAULT_SALT_LENGTH

const DEFAULT_SALT_LENGTH = 32

Default length of salt in bytes

Definition at line 41 of file Encryptor.php.

DELIMITER

const DELIMITER = ':'

#- Default hash string delimiter

Definition at line 73 of file Encryptor.php.

HASH_VERSION_LATEST

const HASH_VERSION_LATEST = 1

Key of latest used algorithm

Definition at line 36 of file Encryptor.php.

HASH_VERSION_MD5

const HASH_VERSION_MD5 = 0

Key of md5 algorithm

Definition at line 26 of file Encryptor.php.

HASH_VERSION_SHA256

const HASH_VERSION_SHA256 = 1

Key of sha256 algorithm

Definition at line 31 of file Encryptor.php.

PARAM_CRYPT_KEY

const PARAM_CRYPT_KEY = 'crypt/key'

#- Array key of encryption key in deployment config

Definition at line 54 of file Encryptor.php.

PASSWORD_HASH

const PASSWORD_HASH = 0

#+ Exploded password hash keys

Definition at line 46 of file Encryptor.php.

PASSWORD_SALT

const PASSWORD_SALT = 1

Definition at line 47 of file Encryptor.php.

PASSWORD_VERSION

const PASSWORD_VERSION = 2

Definition at line 48 of file Encryptor.php.

---

The documentation for this class was generated from the following file:

• vendor/magento/framework/Encryption/Encryptor.php