ElggCrypto.php

Go to the documentation of this file.

<?php
class ElggCrypto {

    const CHARS_PASSWORD = 'bcdfghjklmnpqrstvwxyz2346789';

    const CHARS_HEX = '0123456789abcdef';

    public function getRandomBytes($length) {
        $SSLstr = '4'; // http://xkcd.com/221/
        if (function_exists('openssl_random_pseudo_bytes')
                && (version_compare(PHP_VERSION, '5.3.4') >= 0 || substr(PHP_OS, 0, 3) !== 'WIN')) {
            $SSLstr = openssl_random_pseudo_bytes($length, $strong);
            if ($strong) {
                return $SSLstr;
            }
        }

        if (function_exists('mcrypt_create_iv')
                && (version_compare(PHP_VERSION, '5.3.7') >= 0 || substr(PHP_OS, 0, 3) !== 'WIN')) {
            $str = mcrypt_create_iv($length, MCRYPT_DEV_URANDOM);
            if ($str !== false) {
                return $str;
            }
        }

        $str = '';
        $bits_per_round = 2; // bits of entropy collected in each clock drift round
        $msec_per_round = 400; // expected running time of each round in microseconds
        $hash_len = 20; // SHA-1 Hash length
        $total = $length; // total bytes of entropy to collect

        $handle = @fopen('/dev/urandom', 'rb');
        if ($handle && function_exists('stream_set_read_buffer')) {
            @stream_set_read_buffer($handle, 0);
        }

        do {
            $bytes = ($total > $hash_len) ? $hash_len : $total;
            $total -= $bytes;

            //collect any entropy available from the PHP system and filesystem
            $entropy = rand() . uniqid(mt_rand(), true) . $SSLstr;
            $entropy .= implode('', @fstat(@fopen(__FILE__, 'r')));
            $entropy .= memory_get_usage() . getmypid();
            $entropy .= serialize($_ENV) . serialize($_SERVER);
            if (function_exists('posix_times')) {
                $entropy .= serialize(posix_times());
            }
            if (function_exists('zend_thread_id')) {
                $entropy .= zend_thread_id();
            }

            if ($handle) {
                $entropy .= @fread($handle, $bytes);
            } else {
                // Measure the time that the operations will take on average
                for ($i = 0; $i < 3; $i++) {
                    $c1 = microtime(true);
                    $var = sha1(mt_rand());
                    for ($j = 0; $j < 50; $j++) {
                        $var = sha1($var);
                    }
                    $c2 = microtime(true);
                    $entropy .= $c1 . $c2;
                }

                // Based on the above measurement determine the total rounds
                // in order to bound the total running time.
                $rounds = (int) ($msec_per_round * 50 / (int) (($c2 - $c1) * 1000000));

                // Take the additional measurements. On average we can expect
                // at least $bits_per_round bits of entropy from each measurement.
                $iter = $bytes * (int) (ceil(8 / $bits_per_round));

                for ($i = 0; $i < $iter; $i++) {
                    $c1 = microtime();
                    $var = sha1(mt_rand());
                    for ($j = 0; $j < $rounds; $j++) {
                        $var = sha1($var);
                    }
                    $c2 = microtime();
                    $entropy .= $c1 . $c2;
                }
            }

            // We assume sha1 is a deterministic extractor for the $entropy variable.
            $str .= sha1($entropy, true);

        } while ($length > strlen($str));

        if ($handle) {
            @fclose($handle);
        }

        return substr($str, 0, $length);
    }

    public function getRandomString($length, $chars = null) {
        if ($length < 1) {
            throw new InvalidArgumentException('Length should be >= 1');
        }

        if (empty($chars)) {
            $numBytes = ceil($length * 0.75);
            $bytes    = $this->getRandomBytes($numBytes);
            $string = substr(rtrim(base64_encode($bytes), '='), 0, $length);

            // Base64 URL
            return strtr($string, '+/', '-_');
        }

        if ($chars == self::CHARS_HEX) {
            // hex is easy
            $bytes = $this->getRandomBytes(ceil($length / 2));
            return substr(bin2hex($bytes), 0, $length);
        }

        $listLen = strlen($chars);

        if ($listLen == 1) {
            return str_repeat($chars, $length);
        }

        $bytes  = $this->getRandomBytes($length);
        $pos    = 0;
        $result = '';
        for ($i = 0; $i < $length; $i++) {
            $pos     = ($pos + ord($bytes[$i])) % $listLen;
            $result .= $chars[$pos];
        }

        return $result;
    }
}