OpenSSL.php 3.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123
  1. <?php
  2. /*
  3. * The RandomLib library for securely generating random numbers and strings in PHP
  4. *
  5. * @author Anthony Ferrara <ircmaxell@ircmaxell.com>
  6. * @copyright 2011 The Authors
  7. * @license http://www.opensource.org/licenses/mit-license.html MIT License
  8. * @version Build @@version@@
  9. */
  10. /**
  11. * The OpenSSL Random Number Source
  12. *
  13. * This uses the OS's secure generator to generate high strength numbers
  14. *
  15. * PHP version 5.3
  16. *
  17. * @category PHPCryptLib
  18. * @package Random
  19. * @subpackage Source
  20. *
  21. * @author Anthony Ferrara <ircmaxell@ircmaxell.com>
  22. * @author Paragon Initiative Enterprises <security@paragonie.com>
  23. * @copyright 2011 The Authors
  24. * @license http://www.opensource.org/licenses/mit-license.html MIT License
  25. *
  26. * @version Build @@version@@
  27. */
  28. namespace RandomLib\Source;
  29. use SecurityLib\Strength;
  30. /**
  31. * The OpenSSL Random Number Source
  32. *
  33. * This uses the OS's secure generator to generate high strength numbers
  34. *
  35. * @category PHPCryptLib
  36. * @package Random
  37. * @subpackage Source
  38. *
  39. * @author Anthony Ferrara <ircmaxell@ircmaxell.com>
  40. * @author Paragon Initiative Enterprises <security@paragonie.com>
  41. * @codeCoverageIgnore
  42. */
  43. class OpenSSL extends \RandomLib\AbstractSource
  44. {
  45. /**
  46. * Return an instance of Strength indicating the strength of the source
  47. *
  48. * PIE notes: Userland PRNGs are not high strength. OpenSSL is, at best, medium.
  49. *
  50. * @return \SecurityLib\Strength An instance of one of the strength classes
  51. */
  52. public static function getStrength()
  53. {
  54. /**
  55. * Prior to PHP 5.6.12 (see https://bugs.php.net/bug.php?id=70014) the "openssl_random_pseudo_bytes"
  56. * was using "RAND_pseudo_bytes" (predictable) instead of "RAND_bytes" (unpredictable).
  57. * Release notes: http://php.net/ChangeLog-5.php#5.6.12
  58. */
  59. if (PHP_VERSION_ID >= 50612) {
  60. return new Strength(Strength::MEDIUM);
  61. }
  62. /**
  63. * Prior to PHP 5.5.28 (see https://bugs.php.net/bug.php?id=70014) the "openssl_random_pseudo_bytes"
  64. * was using "RAND_pseudo_bytes" (predictable) instead of "RAND_bytes" (unpredictable).
  65. * Release notes: http://php.net/ChangeLog-5.php#5.5.28
  66. */
  67. if (PHP_VERSION_ID >= 50528 && PHP_VERSION_ID < 50600) {
  68. return new Strength(Strength::MEDIUM);
  69. }
  70. /**
  71. * Prior to PHP 5.4.44 (see https://bugs.php.net/bug.php?id=70014) the "openssl_random_pseudo_bytes"
  72. * was using "RAND_pseudo_bytes" (predictable) instead of "RAND_bytes" (unpredictable).
  73. * Release notes: http://php.net/ChangeLog-5.php#5.4.44
  74. */
  75. if (PHP_VERSION_ID >= 50444 && PHP_VERSION_ID < 50500) {
  76. return new Strength(Strength::MEDIUM);
  77. }
  78. return new Strength(Strength::LOW);
  79. }
  80. /**
  81. * If the source is currently available.
  82. * Reasons might be because the library is not installed
  83. *
  84. * @return bool
  85. */
  86. public static function isSupported()
  87. {
  88. return \is_callable('openssl_random_pseudo_bytes');
  89. }
  90. /**
  91. * Generate a random string of the specified size
  92. *
  93. * @param int $size The size of the requested random string
  94. *
  95. * @return string A string of the requested size
  96. */
  97. public function generate($size)
  98. {
  99. if ($size < 1) {
  100. return str_repeat(chr(0), $size);
  101. }
  102. /**
  103. * PIE notes: This $crypto_string argument doesn't do what people think
  104. * it does. Original comment follows.
  105. *
  106. * Note, normally we would check the return of of $crypto_strong to
  107. * ensure that we generated a good random string. However, since we're
  108. * using this as one part of many sources a low strength random number
  109. * shouldn't be much of an issue.
  110. */
  111. return openssl_random_pseudo_bytes($size);
  112. }
  113. }