Use OpenSSL functions if mcrypt is not available #6826
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
added 20 commits
February 28, 2018 11:57
Introduce a helper class called KCryptoWrapper that will determine whether to use OpenSSL or Mcrypt based on the value of the php_crypto_ext "kConf" directive
- add whitespaces to adhere to the general coding style - as requested by Erans, avoid use of kConf to determine which extension to use, if mcrypt is loaded use it, otherwise, use openssl
attempt to use the KCryptoWrapper class fails
| const AES_METHOD = 'AES-128-CBC'; | ||
| const DES3_METHOD = 'DES-EDE3'; | ||
|
|
||
| public static function random_pseudo_bytes($bytes) |
There was a problem hiding this comment.
rename bytes to length or size, since it may be confusing.
There was a problem hiding this comment.
I don't think it's confusing but renamed it to $length anyhow since it's not worth arguing about.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This is the server side follow up of kaltura/clients-generator#278
Starting from PHP 7.1, the Mcrypt extension is deprecated.
There is a good underlying reason for that, to wit: libmcrypt's last update was back in 2007. This is bad for any piece of code but especially troubling for security sensitive ones.
The pulls above will ensure compatibility with KS strings generated using Mcrypt because we set the OPENSSL_ZERO_PADDING bit and do our own padding thus making it compatible with mcrypt's zero padding, as opposed to OpenSSL's default which is PKCS#7.
More info about this can be found here:
http://thefsb.tumblr.com/post/110749271235/using-opensslendecrypt-in-php-instead-of
and in particular under the "Encoding, padding and OPENSSL_RAW_DATA vs.
OPENSSL_ZERO_PADDING" section.