mirror of
https://github.com/WordPress/WordPress.git
synced 2024-09-27 06:42:56 +02:00
aa22aba0ba
The latest version of sodium_compat includes some improvements, as well as a new feature which will also be included in PHP 8.2. * Fixed issues with the PHP autoloader: * [https://github.com/paragonie/sodium_compat/pull/145 #145]: For WordPress, this ensures when Ed25519 is included, so too is the class it inherits from. * [https://github.com/paragonie/sodium_compat/issues/148 #148], [https://github.com/paragonie/sodium_compat/issues/149 #149]: For PHP 7.4+ with opcache preloading, this ensures the include guards don't fail. * [https://github.com/paragonie/sodium_compat/pull/144 #144]: Added `sodium_crypto_stream_xchacha20_xor_ic()` * See [https://github.com/php/php-src/pull/8276 pull request for php-src] (merged in PHP 8.2) * For motivation: [https://github.com/paragonie/halite/issues/178 paragonie/halite#178] Release notes: https://github.com/paragonie/sodium_compat/releases/tag/v1.18.0 A full list of changes in this update can be found on GitHub: https://github.com/paragonie/sodium_compat/compare/v1.17.1...v1.18.0 Follow-up to [49741], [51002], [51591], [52988]. Props jrf, paragoninitiativeenterprises. Fixes #56564. Built from https://develop.svn.wordpress.org/trunk@54150 git-svn-id: http://core.svn.wordpress.org/trunk@53709 1a063a9b-81f0-0310-95a4-ce76da25c4cd
486 lines
15 KiB
PHP
486 lines
15 KiB
PHP
<?php
|
|
|
|
if (class_exists('ParagonIE_Sodium_Core32_Ed25519', false)) {
|
|
return;
|
|
}
|
|
if (!class_exists('ParagonIE_Sodium_Core32_Curve25519')) {
|
|
require_once dirname(__FILE__) . '/Curve25519.php';
|
|
}
|
|
|
|
/**
|
|
* Class ParagonIE_Sodium_Core32_Ed25519
|
|
*/
|
|
abstract class ParagonIE_Sodium_Core32_Ed25519 extends ParagonIE_Sodium_Core32_Curve25519
|
|
{
|
|
const KEYPAIR_BYTES = 96;
|
|
const SEED_BYTES = 32;
|
|
|
|
/**
|
|
* @internal You should not use this directly from another application
|
|
*
|
|
* @return string (96 bytes)
|
|
* @throws Exception
|
|
* @throws SodiumException
|
|
* @throws TypeError
|
|
*/
|
|
public static function keypair()
|
|
{
|
|
$seed = random_bytes(self::SEED_BYTES);
|
|
$pk = '';
|
|
$sk = '';
|
|
self::seed_keypair($pk, $sk, $seed);
|
|
return $sk . $pk;
|
|
}
|
|
|
|
/**
|
|
* @internal You should not use this directly from another application
|
|
*
|
|
* @param string $pk
|
|
* @param string $sk
|
|
* @param string $seed
|
|
* @return string
|
|
* @throws SodiumException
|
|
* @throws TypeError
|
|
*/
|
|
public static function seed_keypair(&$pk, &$sk, $seed)
|
|
{
|
|
if (self::strlen($seed) !== self::SEED_BYTES) {
|
|
throw new RangeException('crypto_sign keypair seed must be 32 bytes long');
|
|
}
|
|
|
|
/** @var string $pk */
|
|
$pk = self::publickey_from_secretkey($seed);
|
|
$sk = $seed . $pk;
|
|
return $sk;
|
|
}
|
|
|
|
/**
|
|
* @internal You should not use this directly from another application
|
|
*
|
|
* @param string $keypair
|
|
* @return string
|
|
* @throws TypeError
|
|
*/
|
|
public static function secretkey($keypair)
|
|
{
|
|
if (self::strlen($keypair) !== self::KEYPAIR_BYTES) {
|
|
throw new RangeException('crypto_sign keypair must be 96 bytes long');
|
|
}
|
|
return self::substr($keypair, 0, 64);
|
|
}
|
|
|
|
/**
|
|
* @internal You should not use this directly from another application
|
|
*
|
|
* @param string $keypair
|
|
* @return string
|
|
* @throws RangeException
|
|
* @throws TypeError
|
|
*/
|
|
public static function publickey($keypair)
|
|
{
|
|
if (self::strlen($keypair) !== self::KEYPAIR_BYTES) {
|
|
throw new RangeException('crypto_sign keypair must be 96 bytes long');
|
|
}
|
|
return self::substr($keypair, 64, 32);
|
|
}
|
|
|
|
/**
|
|
* @internal You should not use this directly from another application
|
|
*
|
|
* @param string $sk
|
|
* @return string
|
|
* @throws SodiumException
|
|
* @throws TypeError
|
|
*/
|
|
public static function publickey_from_secretkey($sk)
|
|
{
|
|
/** @var string $sk */
|
|
$sk = hash('sha512', self::substr($sk, 0, 32), true);
|
|
$sk[0] = self::intToChr(
|
|
self::chrToInt($sk[0]) & 248
|
|
);
|
|
$sk[31] = self::intToChr(
|
|
(self::chrToInt($sk[31]) & 63) | 64
|
|
);
|
|
return self::sk_to_pk($sk);
|
|
}
|
|
|
|
/**
|
|
* @param string $pk
|
|
* @return string
|
|
* @throws SodiumException
|
|
* @throws TypeError
|
|
*/
|
|
public static function pk_to_curve25519($pk)
|
|
{
|
|
if (self::small_order($pk)) {
|
|
throw new SodiumException('Public key is on a small order');
|
|
}
|
|
$A = self::ge_frombytes_negate_vartime($pk);
|
|
$p1 = self::ge_mul_l($A);
|
|
if (!self::fe_isnonzero($p1->X)) {
|
|
throw new SodiumException('Unexpected zero result');
|
|
}
|
|
|
|
# fe_1(one_minus_y);
|
|
# fe_sub(one_minus_y, one_minus_y, A.Y);
|
|
# fe_invert(one_minus_y, one_minus_y);
|
|
$one_minux_y = self::fe_invert(
|
|
self::fe_sub(
|
|
self::fe_1(),
|
|
$A->Y
|
|
)
|
|
);
|
|
|
|
|
|
# fe_1(x);
|
|
# fe_add(x, x, A.Y);
|
|
# fe_mul(x, x, one_minus_y);
|
|
$x = self::fe_mul(
|
|
self::fe_add(self::fe_1(), $A->Y),
|
|
$one_minux_y
|
|
);
|
|
|
|
# fe_tobytes(curve25519_pk, x);
|
|
return self::fe_tobytes($x);
|
|
}
|
|
|
|
/**
|
|
* @internal You should not use this directly from another application
|
|
*
|
|
* @param string $sk
|
|
* @return string
|
|
* @throws SodiumException
|
|
* @throws TypeError
|
|
*/
|
|
public static function sk_to_pk($sk)
|
|
{
|
|
return self::ge_p3_tobytes(
|
|
self::ge_scalarmult_base(
|
|
self::substr($sk, 0, 32)
|
|
)
|
|
);
|
|
}
|
|
|
|
/**
|
|
* @internal You should not use this directly from another application
|
|
*
|
|
* @param string $message
|
|
* @param string $sk
|
|
* @return string
|
|
* @throws SodiumException
|
|
* @throws TypeError
|
|
*/
|
|
public static function sign($message, $sk)
|
|
{
|
|
/** @var string $signature */
|
|
$signature = self::sign_detached($message, $sk);
|
|
return $signature . $message;
|
|
}
|
|
|
|
/**
|
|
* @internal You should not use this directly from another application
|
|
*
|
|
* @param string $message A signed message
|
|
* @param string $pk Public key
|
|
* @return string Message (without signature)
|
|
* @throws SodiumException
|
|
* @throws TypeError
|
|
*/
|
|
public static function sign_open($message, $pk)
|
|
{
|
|
/** @var string $signature */
|
|
$signature = self::substr($message, 0, 64);
|
|
|
|
/** @var string $message */
|
|
$message = self::substr($message, 64);
|
|
|
|
if (self::verify_detached($signature, $message, $pk)) {
|
|
return $message;
|
|
}
|
|
throw new SodiumException('Invalid signature');
|
|
}
|
|
|
|
/**
|
|
* @internal You should not use this directly from another application
|
|
*
|
|
* @param string $message
|
|
* @param string $sk
|
|
* @return string
|
|
* @throws SodiumException
|
|
* @throws TypeError
|
|
* @psalm-suppress PossiblyInvalidArgument
|
|
*/
|
|
public static function sign_detached($message, $sk)
|
|
{
|
|
# crypto_hash_sha512(az, sk, 32);
|
|
$az = hash('sha512', self::substr($sk, 0, 32), true);
|
|
|
|
# az[0] &= 248;
|
|
# az[31] &= 63;
|
|
# az[31] |= 64;
|
|
$az[0] = self::intToChr(self::chrToInt($az[0]) & 248);
|
|
$az[31] = self::intToChr((self::chrToInt($az[31]) & 63) | 64);
|
|
|
|
# crypto_hash_sha512_init(&hs);
|
|
# crypto_hash_sha512_update(&hs, az + 32, 32);
|
|
# crypto_hash_sha512_update(&hs, m, mlen);
|
|
# crypto_hash_sha512_final(&hs, nonce);
|
|
$hs = hash_init('sha512');
|
|
self::hash_update($hs, self::substr($az, 32, 32));
|
|
self::hash_update($hs, $message);
|
|
$nonceHash = hash_final($hs, true);
|
|
|
|
# memmove(sig + 32, sk + 32, 32);
|
|
$pk = self::substr($sk, 32, 32);
|
|
|
|
# sc_reduce(nonce);
|
|
# ge_scalarmult_base(&R, nonce);
|
|
# ge_p3_tobytes(sig, &R);
|
|
$nonce = self::sc_reduce($nonceHash) . self::substr($nonceHash, 32);
|
|
$sig = self::ge_p3_tobytes(
|
|
self::ge_scalarmult_base($nonce)
|
|
);
|
|
|
|
# crypto_hash_sha512_init(&hs);
|
|
# crypto_hash_sha512_update(&hs, sig, 64);
|
|
# crypto_hash_sha512_update(&hs, m, mlen);
|
|
# crypto_hash_sha512_final(&hs, hram);
|
|
$hs = hash_init('sha512');
|
|
self::hash_update($hs, self::substr($sig, 0, 32));
|
|
self::hash_update($hs, self::substr($pk, 0, 32));
|
|
self::hash_update($hs, $message);
|
|
$hramHash = hash_final($hs, true);
|
|
|
|
# sc_reduce(hram);
|
|
# sc_muladd(sig + 32, hram, az, nonce);
|
|
$hram = self::sc_reduce($hramHash);
|
|
$sigAfter = self::sc_muladd($hram, $az, $nonce);
|
|
$sig = self::substr($sig, 0, 32) . self::substr($sigAfter, 0, 32);
|
|
|
|
try {
|
|
ParagonIE_Sodium_Compat::memzero($az);
|
|
} catch (SodiumException $ex) {
|
|
$az = null;
|
|
}
|
|
return $sig;
|
|
}
|
|
|
|
/**
|
|
* @internal You should not use this directly from another application
|
|
*
|
|
* @param string $sig
|
|
* @param string $message
|
|
* @param string $pk
|
|
* @return bool
|
|
* @throws SodiumException
|
|
* @throws TypeError
|
|
*/
|
|
public static function verify_detached($sig, $message, $pk)
|
|
{
|
|
if (self::strlen($sig) < 64) {
|
|
throw new SodiumException('Signature is too short');
|
|
}
|
|
if ((self::chrToInt($sig[63]) & 240) && self::check_S_lt_L(self::substr($sig, 32, 32))) {
|
|
throw new SodiumException('S < L - Invalid signature');
|
|
}
|
|
if (self::small_order($sig)) {
|
|
throw new SodiumException('Signature is on too small of an order');
|
|
}
|
|
if ((self::chrToInt($sig[63]) & 224) !== 0) {
|
|
throw new SodiumException('Invalid signature');
|
|
}
|
|
$d = 0;
|
|
for ($i = 0; $i < 32; ++$i) {
|
|
$d |= self::chrToInt($pk[$i]);
|
|
}
|
|
if ($d === 0) {
|
|
throw new SodiumException('All zero public key');
|
|
}
|
|
|
|
/** @var bool The original value of ParagonIE_Sodium_Compat::$fastMult */
|
|
$orig = ParagonIE_Sodium_Compat::$fastMult;
|
|
|
|
// Set ParagonIE_Sodium_Compat::$fastMult to true to speed up verification.
|
|
ParagonIE_Sodium_Compat::$fastMult = true;
|
|
|
|
/** @var ParagonIE_Sodium_Core32_Curve25519_Ge_P3 $A */
|
|
$A = self::ge_frombytes_negate_vartime($pk);
|
|
|
|
/** @var string $hDigest */
|
|
$hDigest = hash(
|
|
'sha512',
|
|
self::substr($sig, 0, 32) .
|
|
self::substr($pk, 0, 32) .
|
|
$message,
|
|
true
|
|
);
|
|
|
|
/** @var string $h */
|
|
$h = self::sc_reduce($hDigest) . self::substr($hDigest, 32);
|
|
|
|
/** @var ParagonIE_Sodium_Core32_Curve25519_Ge_P2 $R */
|
|
$R = self::ge_double_scalarmult_vartime(
|
|
$h,
|
|
$A,
|
|
self::substr($sig, 32)
|
|
);
|
|
|
|
/** @var string $rcheck */
|
|
$rcheck = self::ge_tobytes($R);
|
|
|
|
// Reset ParagonIE_Sodium_Compat::$fastMult to what it was before.
|
|
ParagonIE_Sodium_Compat::$fastMult = $orig;
|
|
|
|
return self::verify_32($rcheck, self::substr($sig, 0, 32));
|
|
}
|
|
|
|
/**
|
|
* @internal You should not use this directly from another application
|
|
*
|
|
* @param string $S
|
|
* @return bool
|
|
* @throws SodiumException
|
|
* @throws TypeError
|
|
*/
|
|
public static function check_S_lt_L($S)
|
|
{
|
|
if (self::strlen($S) < 32) {
|
|
throw new SodiumException('Signature must be 32 bytes');
|
|
}
|
|
static $L = array(
|
|
0xed, 0xd3, 0xf5, 0x5c, 0x1a, 0x63, 0x12, 0x58,
|
|
0xd6, 0x9c, 0xf7, 0xa2, 0xde, 0xf9, 0xde, 0x14,
|
|
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
|
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10
|
|
);
|
|
/** @var array<int, int> $L */
|
|
$c = 0;
|
|
$n = 1;
|
|
$i = 32;
|
|
|
|
do {
|
|
--$i;
|
|
$x = self::chrToInt($S[$i]);
|
|
$c |= (
|
|
(($x - $L[$i]) >> 8) & $n
|
|
);
|
|
$n &= (
|
|
(($x ^ $L[$i]) - 1) >> 8
|
|
);
|
|
} while ($i !== 0);
|
|
|
|
return $c === 0;
|
|
}
|
|
|
|
/**
|
|
* @param string $R
|
|
* @return bool
|
|
* @throws SodiumException
|
|
* @throws TypeError
|
|
*/
|
|
public static function small_order($R)
|
|
{
|
|
static $blocklist = array(
|
|
/* 0 (order 4) */
|
|
array(
|
|
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
|
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
|
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
|
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
|
|
),
|
|
/* 1 (order 1) */
|
|
array(
|
|
0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
|
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
|
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
|
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
|
|
),
|
|
/* 2707385501144840649318225287225658788936804267575313519463743609750303402022 (order 8) */
|
|
array(
|
|
0x26, 0xe8, 0x95, 0x8f, 0xc2, 0xb2, 0x27, 0xb0,
|
|
0x45, 0xc3, 0xf4, 0x89, 0xf2, 0xef, 0x98, 0xf0,
|
|
0xd5, 0xdf, 0xac, 0x05, 0xd3, 0xc6, 0x33, 0x39,
|
|
0xb1, 0x38, 0x02, 0x88, 0x6d, 0x53, 0xfc, 0x05
|
|
),
|
|
/* 55188659117513257062467267217118295137698188065244968500265048394206261417927 (order 8) */
|
|
array(
|
|
0xc7, 0x17, 0x6a, 0x70, 0x3d, 0x4d, 0xd8, 0x4f,
|
|
0xba, 0x3c, 0x0b, 0x76, 0x0d, 0x10, 0x67, 0x0f,
|
|
0x2a, 0x20, 0x53, 0xfa, 0x2c, 0x39, 0xcc, 0xc6,
|
|
0x4e, 0xc7, 0xfd, 0x77, 0x92, 0xac, 0x03, 0x7a
|
|
),
|
|
/* p-1 (order 2) */
|
|
array(
|
|
0x13, 0xe8, 0x95, 0x8f, 0xc2, 0xb2, 0x27, 0xb0,
|
|
0x45, 0xc3, 0xf4, 0x89, 0xf2, 0xef, 0x98, 0xf0,
|
|
0xd5, 0xdf, 0xac, 0x05, 0xd3, 0xc6, 0x33, 0x39,
|
|
0xb1, 0x38, 0x02, 0x88, 0x6d, 0x53, 0xfc, 0x85
|
|
),
|
|
/* p (order 4) */
|
|
array(
|
|
0xb4, 0x17, 0x6a, 0x70, 0x3d, 0x4d, 0xd8, 0x4f,
|
|
0xba, 0x3c, 0x0b, 0x76, 0x0d, 0x10, 0x67, 0x0f,
|
|
0x2a, 0x20, 0x53, 0xfa, 0x2c, 0x39, 0xcc, 0xc6,
|
|
0x4e, 0xc7, 0xfd, 0x77, 0x92, 0xac, 0x03, 0xfa
|
|
),
|
|
/* p+1 (order 1) */
|
|
array(
|
|
0xec, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
|
|
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
|
|
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
|
|
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f
|
|
),
|
|
/* p+2707385501144840649318225287225658788936804267575313519463743609750303402022 (order 8) */
|
|
array(
|
|
0xed, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
|
|
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
|
|
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
|
|
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f
|
|
),
|
|
/* p+55188659117513257062467267217118295137698188065244968500265048394206261417927 (order 8) */
|
|
array(
|
|
0xee, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
|
|
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
|
|
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
|
|
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f
|
|
),
|
|
/* 2p-1 (order 2) */
|
|
array(
|
|
0xd9, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
|
|
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
|
|
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
|
|
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
|
|
),
|
|
/* 2p (order 4) */
|
|
array(
|
|
0xda, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
|
|
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
|
|
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
|
|
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
|
|
),
|
|
/* 2p+1 (order 1) */
|
|
array(
|
|
0xdb, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
|
|
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
|
|
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
|
|
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
|
|
)
|
|
);
|
|
/** @var array<int, array<int, int>> $blocklist */
|
|
$countBlocklist = count($blocklist);
|
|
|
|
for ($i = 0; $i < $countBlocklist; ++$i) {
|
|
$c = 0;
|
|
for ($j = 0; $j < 32; ++$j) {
|
|
$c |= self::chrToInt($R[$j]) ^ $blocklist[$i][$j];
|
|
}
|
|
if ($c === 0) {
|
|
return true;
|
|
}
|
|
}
|
|
return false;
|
|
}
|
|
}
|