Skip to content

Commit 8d8e56c

Browse files
robrichardsrobrichards
committed
Add AES-GCM support.
Prep for 3.1.0 release
1 parent 2fe9594 commit 8d8e56c

12 files changed

+367
-9
lines changed

‎CHANGELOG.txt

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,15 @@
11
xmlseclibs.php
22
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
3-
??, ??? 2018, 3.0.5-dev
3+
22, Apr 2020, 3.1.0
4+
Features:
5+
- Support AES-GCM. Requires PHP 7.1. (François Kooman)
6+
7+
Improvements:
8+
- Fix Travis tests for older PHP versions.
9+
- Use DOMElement interface to fix some IDEs reporting documentation errors
10+
11+
Bug Fixes:
12+
- FIX missing InclusiveNamespaces PrefixList from Java + Apache WSS4J. (njake)
413

514
06, Nov 2019, 3.0.4
615
Security Improvements:

‎src/XMLSecurityKey.php

Lines changed: 56 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,9 @@ class XMLSecurityKey
5050
const AES128_CBC = 'http://www.w3.org/2001/04/xmlenc#aes128-cbc';
5151
const AES192_CBC = 'http://www.w3.org/2001/04/xmlenc#aes192-cbc';
5252
const AES256_CBC = 'http://www.w3.org/2001/04/xmlenc#aes256-cbc';
53+
const AES128_GCM = 'http://www.w3.org/2009/xmlenc11#aes128-gcm';
54+
const AES192_GCM = 'http://www.w3.org/2009/xmlenc11#aes192-gcm';
55+
const AES256_GCM = 'http://www.w3.org/2009/xmlenc11#aes256-gcm';
5356
const RSA_1_5 = 'http://www.w3.org/2001/04/xmlenc#rsa-1_5';
5457
const RSA_OAEP_MGF1P = 'http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p';
5558
const DSA_SHA1 = 'http://www.w3.org/2000/09/xmldsig#dsa-sha1';
@@ -58,6 +61,7 @@ class XMLSecurityKey
5861
const RSA_SHA384 = 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha384';
5962
const RSA_SHA512 = 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha512';
6063
const HMAC_SHA1 = 'http://www.w3.org/2000/09/xmldsig#hmac-sha1';
64+
const AUTHTAG_LENGTH = 16;
6165

6266
/** @var array */
6367
private $cryptParams = array();
@@ -142,6 +146,30 @@ public function __construct($type, $params=null)
142146
$this->cryptParams['keysize'] = 32;
143147
$this->cryptParams['blocksize'] = 16;
144148
break;
149+
case (self::AES128_GCM):
150+
$this->cryptParams['library'] = 'openssl';
151+
$this->cryptParams['cipher'] = 'aes-128-gcm';
152+
$this->cryptParams['type'] = 'symmetric';
153+
$this->cryptParams['method'] = 'http://www.w3.org/2009/xmlenc11#aes128-gcm';
154+
$this->cryptParams['keysize'] = 32;
155+
$this->cryptParams['blocksize'] = 16;
156+
break;
157+
case (self::AES192_GCM):
158+
$this->cryptParams['library'] = 'openssl';
159+
$this->cryptParams['cipher'] = 'aes-192-gcm';
160+
$this->cryptParams['type'] = 'symmetric';
161+
$this->cryptParams['method'] = 'http://www.w3.org/2009/xmlenc11#aes192-gcm';
162+
$this->cryptParams['keysize'] = 32;
163+
$this->cryptParams['blocksize'] = 16;
164+
break;
165+
case (self::AES256_GCM):
166+
$this->cryptParams['library'] = 'openssl';
167+
$this->cryptParams['cipher'] = 'aes-256-gcm';
168+
$this->cryptParams['type'] = 'symmetric';
169+
$this->cryptParams['method'] = 'http://www.w3.org/2009/xmlenc11#aes256-gcm';
170+
$this->cryptParams['keysize'] = 32;
171+
$this->cryptParams['blocksize'] = 16;
172+
break;
145173
case (self::RSA_1_5):
146174
$this->cryptParams['library'] = 'openssl';
147175
$this->cryptParams['padding'] = OPENSSL_PKCS1_PADDING;
@@ -397,12 +425,22 @@ private function unpadISO10126($data)
397425
private function encryptSymmetric($data)
398426
{
399427
$this->iv = openssl_random_pseudo_bytes(openssl_cipher_iv_length($this->cryptParams['cipher']));
400-
$data = $this->padISO10126($data, $this->cryptParams['blocksize']);
401-
$encrypted = openssl_encrypt($data, $this->cryptParams['cipher'], $this->key, OPENSSL_RAW_DATA | OPENSSL_ZERO_PADDING, $this->iv);
428+
$authTag = null;
429+
if(in_array($this->cryptParams['cipher'], ['aes-128-gcm', 'aes-192-gcm', 'aes-256-gcm'])) {
430+
if (version_compare(PHP_VERSION, '7.1.0') < 0) {
431+
throw new Exception('PHP 7.1.0 is required to use AES GCM algorithms');
432+
}
433+
$authTag = openssl_random_pseudo_bytes(self::AUTHTAG_LENGTH);
434+
$encrypted = openssl_encrypt($data, $this->cryptParams['cipher'], $this->key, OPENSSL_RAW_DATA, $this->iv, $authTag);
435+
} else {
436+
$data = $this->padISO10126($data, $this->cryptParams['blocksize']);
437+
$encrypted = openssl_encrypt($data, $this->cryptParams['cipher'], $this->key, OPENSSL_RAW_DATA | OPENSSL_ZERO_PADDING, $this->iv);
438+
}
439+
402440
if (false === $encrypted) {
403441
throw new Exception('Failure encrypting Data (openssl symmetric) - ' . openssl_error_string());
404442
}
405-
return $this->iv . $encrypted;
443+
return $this->iv . $encrypted . $authTag;
406444
}
407445

408446
/**
@@ -416,11 +454,24 @@ private function decryptSymmetric($data)
416454
$iv_length = openssl_cipher_iv_length($this->cryptParams['cipher']);
417455
$this->iv = substr($data, 0, $iv_length);
418456
$data = substr($data, $iv_length);
419-
$decrypted = openssl_decrypt($data, $this->cryptParams['cipher'], $this->key, OPENSSL_RAW_DATA | OPENSSL_ZERO_PADDING, $this->iv);
457+
$authTag = null;
458+
if(in_array($this->cryptParams['cipher'], ['aes-128-gcm', 'aes-192-gcm', 'aes-256-gcm'])) {
459+
if (version_compare(PHP_VERSION, '7.1.0') < 0) {
460+
throw new Exception('PHP 7.1.0 is required to use AES GCM algorithms');
461+
}
462+
// obtain and remove the authentication tag
463+
$offset = 0 - self::AUTHTAG_LENGTH;
464+
$authTag = substr($data, $offset);
465+
$data = substr($data, 0, $offset);
466+
$decrypted = openssl_decrypt($data, $this->cryptParams['cipher'], $this->key, OPENSSL_RAW_DATA, $this->iv, $authTag);
467+
} else {
468+
$decrypted = openssl_decrypt($data, $this->cryptParams['cipher'], $this->key, OPENSSL_RAW_DATA | OPENSSL_ZERO_PADDING, $this->iv);
469+
}
470+
420471
if (false === $decrypted) {
421472
throw new Exception('Failure decrypting Data (openssl symmetric) - ' . openssl_error_string());
422473
}
423-
return $this->unpadISO10126($decrypted);
474+
return null !== $authTag ? $decrypted : $this->unpadISO10126($decrypted);
424475
}
425476

426477
/**

‎tests/aes128-gcm-res.xml

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!-- Basic XML example -->
3+
<xenc:EncryptedData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" Type="http://www.w3.org/2001/04/xmlenc#Element"><xenc:EncryptionMethod Algorithm="http://www.w3.org/2009/xmlenc11#aes128-gcm"/><dsig:KeyInfo xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"><xenc:EncryptedKey><xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p"/><xenc:CipherData><xenc:CipherValue>rrX5MGztfar3yQz1IAyH4g2rC2g/YoSfS+AU0VnYh3F1bAlqiZADO//zVgntSG+YmzOZf3AxnZkbQgeU0SqqhHQANaWXk9cQcam6YvmP7m+Mz61i3zx3NUnf+5VE//JPIDB/nAoEv1lS/fjHdwUlRhksM8eiI8QZQRnwR46xlK5ixCdnjS1TZWB+lMqnKGsYGCCy8uY0FhhQuC/EHsved66b4fkgOZV2RUng8kSFB14Sbl7+BGgTBK0wEf3jxUHOLKyaJ7pR9iuDuB6iwJ6iAR+hxIPvImX8swSSA6XRmFjO2eQJ0sJrZDKj5If4cgy5PGSr+Dn5XhawY0SnuAz9Wg==</xenc:CipherValue></xenc:CipherData></xenc:EncryptedKey></dsig:KeyInfo>
4+
<xenc:CipherData>
5+
<xenc:CipherValue>NOP0SiaC1UmFtGOa+42ucZxEDMVzxVYCdY0qcIauDmbg4cac0SEMBdzB0H9UJVm8JQ0w/G83ItWaD94ruPI9TFaA6Xlzz0rWyB58xzeTgQj8tjsRewZ+P1IbfZQ5lYMfXcUW</xenc:CipherValue>
6+
</xenc:CipherData>
7+
</xenc:EncryptedData>

‎tests/aes192-gcm-res.xml

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!-- Basic XML example -->
3+
<xenc:EncryptedData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" Type="http://www.w3.org/2001/04/xmlenc#Element"><xenc:EncryptionMethod Algorithm="http://www.w3.org/2009/xmlenc11#aes192-gcm"/><dsig:KeyInfo xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"><xenc:EncryptedKey><xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p"/><xenc:CipherData><xenc:CipherValue>wUHsk5XjaGLrW0BFPd5PqeZfbrGvtEblHVSx97yt20I4QGxrA86fqUg7IL/W1qEpolYiuTFHjOjdZtZVjdbk5K6qbU7v/CgCOq7A9BUGsIodQoNWMP4g8JlHzz+QC+A6MPdpE5FWY5nqlvp9uEc/AEj6sgwer0m4+yTckPyS3q43Lq8f7UpKtUf7KtdtpxO8z3JRFxIrel9WCG7SHgKwqQGK1tBdpqOrAFx/zJ8NyPB0Q4OiArRTW/2bL3ilo2cmaSdqn5NNafKxYnRihMZbSxEaELjVsUKOAGTtUX1BK3FVeRE4hppi1Tt8Q014c21nVK5IU8efMlHm4Gy93o21nw==</xenc:CipherValue></xenc:CipherData></xenc:EncryptedKey></dsig:KeyInfo>
4+
<xenc:CipherData>
5+
<xenc:CipherValue>ECGYFdVmVq4bzwcRmfF7N8R8ZtP04wNFb6kmMOvjKUUhXOAfMVuCFr5vK80Ehkc4J6xOVvz0yPAXeY9N7piEN0A0JjJ9lNgyBSi0a0ssDBqZgg+cSF0/xzJ1ucem68FByQcu</xenc:CipherValue>
6+
</xenc:CipherData>
7+
</xenc:EncryptedData>

‎tests/aes256-gcm-res.xml

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!-- Basic XML example -->
3+
<xenc:EncryptedData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" Type="http://www.w3.org/2001/04/xmlenc#Element"><xenc:EncryptionMethod Algorithm="http://www.w3.org/2009/xmlenc11#aes256-gcm"/><dsig:KeyInfo xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"><xenc:EncryptedKey><xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p"/><xenc:CipherData><xenc:CipherValue>iiuhKthdJ7GKUL51Zr4XlbB9+BuhHUObOq3k6AHiNemgktyJom8BXMVI4lVcMScs8IYqF12fn/0xvCmhBJa2l/Hv0SxJOSpCDF6gdXc8d5H5knrQjJuYfy6XqBS2XidGN1vt/oMkbV7D+K+IHzXsHlrhpJTtqy9XJzZ+rAn3C5HfiFgkPwSrPzNYEc6BTFTJc8LIo+CFrEbDzPg5e4infwFs1w4VNTHJ+1AF3JqMxY+tj1o+uVGIAgktkY32yJMlk+PefYcyqh2UWXHVGHCMmxZqDUghhKjy11qi/arXmHBAHGhI4ZFGX2apjpvuxUDy5xcMlc0M2kUq3l7Aypmrbg==</xenc:CipherValue></xenc:CipherData></xenc:EncryptedKey></dsig:KeyInfo>
4+
<xenc:CipherData>
5+
<xenc:CipherValue>ZUssRnr2VTgYBN4nIxa3bsRpcwuRHT/Cw8tBryriqCgI8HfaNg+Qgpnhs24pCepUQ8GoAz7//XWvJxJjAcNUNbhfepSn6yHpVjGEp/LscqAvjSNfsGSXBK+17PVgWE4A7+OT</xenc:CipherValue>
6+
</xenc:CipherData>
7+
</xenc:EncryptedData>

‎tests/saml/encryption.key

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
-----BEGIN PRIVATE KEY-----
2+
MIIG/gIBADANBgkqhkiG9w0BAQEFAASCBugwggbkAgEAAoIBgQC29B4AeU9blbZr
3+
QXmHO4JlzqR2sSEgHozA0xXpd88pW1mh7tM/pNumo+KQpzlUuLSnxmhJpAsjPspZ
4+
HQzFZwp+OqacRYXpXJh9w8X8NHsNrwkhk8KDkhDHcelMPgXi+J5Jh6+4klsMweMj
5+
Z6jlEo2NYbeBtK3nndh9gcrjFvPnZf0uI3NwyM0T9VRfjaATYl0VPP1qKo2bPUqr
6+
KoGEoys9+E3DUVlflTLkfNOQeb8zMc1cbgCsiGVv/PXk6oPF+nerG/CbswQpH36y
7+
24Y/ApF7HodBZdj49bZdqaTRGFrw0BePyw7DUBivf5wrONI+cA/592f3dyScASRG
8+
g1RufaE4j+SC+5cBlRnqAXrk7Z482AndwIRPJshy8W3BpjKK85sDr8JYt6oObmIv
9+
zO15mv6f3p4agFxxkbmlEQEveuICasQCH1hnNiyqfAI5Ur5ncWPJrsDB+wsTqcxw
10+
nlPkpe7n9DOIcFfSOYG2aYZhbwsx3/UmoF0XntqBRBG8pxAFUE0CAwEAAQKCAYEA
11+
lClqSpPzcoXx7zZdBulolq4cfoq/+tUCw/2uVx5RxHpYQk25AmeuAmviRadHRJc4
12+
pk6Fkm2pH2fwUu61sv/ZfZRd7VxYMD5uuBrdsXuG0/QWfvy8n/SgZgSYHMh11/Pj
13+
rESYR+8ukUxLeBawrqKxw/eItx/tXg90jV+ZQQMLjzAHM2A+Uu4rNqiNJbz6D/iu
14+
zU5RI7NGbpvaZnfL3/CMSmlWAIFW0ZNwXZ3Bb9VIxFrmpp3nKdJj46eGM1bAVIqb
15+
Eh3lVdAIPLxhsImQNwfiZElul7+jtYD+1mqVfGLzIJLzJjifQlcxWiXFPy8XKoh1
16+
Fg1SjGNnfb6Z/4lTV8oyLsC+Wq7uzxYxCVrNuOF43TBr/N1U7r8+GPYT19aFxzMY
17+
n70JQYlwjikOWReZ/TGdPFLQhgYZIchU6oyB/gaa2JbKhjBJMIGAuekGvusJEUua
18+
ea71dlYut3tAIYmHjJ/nDnSe1TNfRLZHDAZU1nI5QwPecPZhARmUcOithdFsg+i5
19+
AoHBAPN+71Ogn/hrOZ6QnVd/mcc85dtIfL35tLDsHpXGRXNTBMRoZ3TbBtw5FoXu
20+
e+6BBxq5GdDP8NKaXehbZmPN1Wga4/wbzpT2xn+R2Dl4HFf7+UbW1qt+r1TmQ/0t
21+
P81yZ/lEX6XedyJSfUCdM6lABcoNrvFGcpPNcm+8+kY1OSAwotODim8y0iOoLpRh
22+
o/p+NMrlYlfwL+NukdfJjyXUQZ0FWq4QpI2BY8cEh04GpPqVZYpNd8QMAQH4sddM
23+
vz2CFwKBwQDAWUbWTxRvgKgmCXE2WHxCj1t937gaH6Z02VPDmbR2wTEKobBes1UO
24+
yp6+CHdkr6CbFgRTGL86LGIlOSK8x860KvdiZJqe5LCWeZhyEFT0m1kArNYRsDxs
25+
jxcjw0oEZUW99bA/UsdItiVYlEK8/vUt6VY5fOfetH4Q538l0C9igPYkebcj8RiB
26+
jUGl9K6rA9DiKr06OXIYu02Y/LOVMf5B6imAhYON7olLS0EYcrGmGY6rvsl3/OZ4
27+
UHdQ8yjYczsCgcEA1vU4Upt6ndQLCfCg9p2vJDSetvdHKG9JFOdeGNrwdN7VVo7U
28+
xlSVudSsDZB72BIQM4c1QyJPd5zPSlFmErWjsEQNAIOL2/X/Rp96Q0HFw+auKdt/
29+
p+Yu4sRlQRyxNq3JHEVAKy45/hLUgDZHZSMf+UAbMOUAQXsdi4dJarGRvNky5Yc6
30+
rvAuk0vl0xhfqsO/116pcviXTjBOkDFgLgUz52rSotgObN3NN+THjhpPiuhYu7+n
31+
+2qdeSAT3/3g1mwBAoHAPmZ4GZxsB8RYSIa1qKjKHxm817gVVLxB1xSOHR2nMwN3
32+
snhD7GUHShYnq4S5nvtvAgEBhCe6Gdg+Os8vWskDYOWzfcMfej68nwRxlUeBGB2x
33+
oQtxIynmYF2HZz26rHRiTL8A33ouVoNo2DS49fFMfwl8xIel/VTWtQs074J7bNxj
34+
fe/SnyFfDuBRlNItPCOvxz+QRexO/ID/KouIgvVGBAJAVoZ56DijZ77RLmo/AaC2
35+
7Tamy3tLFWsdWjCYZqfzAoHAN54VE6Yn1OLb6q1WAskrS+OxigDRyT5DUKqPrdjf
36+
nfuibfm/BiSEofqV0KP7l2pGuLqPkVSXnWbbp1gNhKi3Rmr0sMTJhkYT3jyHk51k
37+
qRoJPBtIa6I62cAA6BNDLPiLYawF62fS5E+0jEDaCh1CpRKg0sBd+f9lJq88updg
38+
LakoPQfgYpX/B4NdZnuLb7eSlj4k3fxfMh7eb5U/TGASUVskFJ23CMBk0Z7IKJcm
39+
hd3JVswLnFqpRTh+ZTDZRU8F
40+
-----END PRIVATE KEY-----

‎tests/saml/encryption_rsa.key

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
-----BEGIN RSA PRIVATE KEY-----
2+
MIIG5AIBAAKCAYEAtvQeAHlPW5W2a0F5hzuCZc6kdrEhIB6MwNMV6XfPKVtZoe7T
3+
P6TbpqPikKc5VLi0p8ZoSaQLIz7KWR0MxWcKfjqmnEWF6VyYfcPF/DR7Da8JIZPC
4+
g5IQx3HpTD4F4vieSYevuJJbDMHjI2eo5RKNjWG3gbSt553YfYHK4xbz52X9LiNz
5+
cMjNE/VUX42gE2JdFTz9aiqNmz1KqyqBhKMrPfhNw1FZX5Uy5HzTkHm/MzHNXG4A
6+
rIhlb/z15OqDxfp3qxvwm7MEKR9+stuGPwKRex6HQWXY+PW2Xamk0Rha8NAXj8sO
7+
w1AYr3+cKzjSPnAP+fdn93cknAEkRoNUbn2hOI/kgvuXAZUZ6gF65O2ePNgJ3cCE
8+
TybIcvFtwaYyivObA6/CWLeqDm5iL8zteZr+n96eGoBccZG5pREBL3riAmrEAh9Y
9+
ZzYsqnwCOVK+Z3Fjya7AwfsLE6nMcJ5T5KXu5/QziHBX0jmBtmmGYW8LMd/1JqBd
10+
F57agUQRvKcQBVBNAgMBAAECggGBAJQpakqT83KF8e82XQbpaJauHH6Kv/rVAsP9
11+
rlceUcR6WEJNuQJnrgJr4kWnR0SXOKZOhZJtqR9n8FLutbL/2X2UXe1cWDA+brga
12+
3bF7htP0Fn78vJ/0oGYEmBzIddfz46xEmEfvLpFMS3gWsK6iscP3iLcf7V4PdI1f
13+
mUEDC48wBzNgPlLuKzaojSW8+g/4rs1OUSOzRm6b2mZ3y9/wjEppVgCBVtGTcF2d
14+
wW/VSMRa5qad5ynSY+OnhjNWwFSKmxId5VXQCDy8YbCJkDcH4mRJbpe/o7WA/tZq
15+
lXxi8yCS8yY4n0JXMVolxT8vFyqIdRYNUoxjZ32+mf+JU1fKMi7Avlqu7s8WMQla
16+
zbjheN0wa/zdVO6/Phj2E9fWhcczGJ+9CUGJcI4pDlkXmf0xnTxS0IYGGSHIVOqM
17+
gf4GmtiWyoYwSTCBgLnpBr7rCRFLmnmu9XZWLrd7QCGJh4yf5w50ntUzX0S2RwwG
18+
VNZyOUMD3nD2YQEZlHDorYXRbIPouQKBwQDzfu9ToJ/4azmekJ1Xf5nHPOXbSHy9
19+
+bSw7B6VxkVzUwTEaGd02wbcORaF7nvugQcauRnQz/DSml3oW2ZjzdVoGuP8G86U
20+
9sZ/kdg5eBxX+/lG1tarfq9U5kP9LT/Ncmf5RF+l3nciUn1AnTOpQAXKDa7xRnKT
21+
zXJvvPpGNTkgMKLTg4pvMtIjqC6UYaP6fjTK5WJX8C/jbpHXyY8l1EGdBVquEKSN
22+
gWPHBIdOBqT6lWWKTXfEDAEB+LHXTL89ghcCgcEAwFlG1k8Ub4CoJglxNlh8Qo9b
23+
fd+4Gh+mdNlTw5m0dsExCqGwXrNVDsqevgh3ZK+gmxYEUxi/OixiJTkivMfOtCr3
24+
YmSanuSwlnmYchBU9JtZAKzWEbA8bI8XI8NKBGVFvfWwP1LHSLYlWJRCvP71LelW
25+
OXzn3rR+EOd/JdAvYoD2JHm3I/EYgY1BpfSuqwPQ4iq9OjlyGLtNmPyzlTH+Qeop
26+
gIWDje6JS0tBGHKxphmOq77Jd/zmeFB3UPMo2HM7AoHBANb1OFKbep3UCwnwoPad
27+
ryQ0nrb3RyhvSRTnXhja8HTe1VaO1MZUlbnUrA2Qe9gSEDOHNUMiT3ecz0pRZhK1
28+
o7BEDQCDi9v1/0afekNBxcPmrinbf6fmLuLEZUEcsTatyRxFQCsuOf4S1IA2R2Uj
29+
H/lAGzDlAEF7HYuHSWqxkbzZMuWHOq7wLpNL5dMYX6rDv9deqXL4l04wTpAxYC4F
30+
M+dq0qLYDmzdzTfkx44aT4roWLu/p/tqnXkgE9/94NZsAQKBwD5meBmcbAfEWEiG
31+
taioyh8ZvNe4FVS8QdcUjh0dpzMDd7J4Q+xlB0oWJ6uEuZ77bwIBAYQnuhnYPjrP
32+
L1rJA2Dls33DH3o+vJ8EcZVHgRgdsaELcSMp5mBdh2c9uqx0Yky/AN96LlaDaNg0
33+
uPXxTH8JfMSHpf1U1rULNO+Ce2zcY33v0p8hXw7gUZTSLTwjr8c/kEXsTvyA/yqL
34+
iIL1RgQCQFaGeeg4o2e+0S5qPwGgtu02pst7SxVrHVowmGan8wKBwDeeFROmJ9Ti
35+
2+qtVgLJK0vjsYoA0ck+Q1Cqj63Y3537om35vwYkhKH6ldCj+5dqRri6j5FUl51m
36+
26dYDYSot0Zq9LDEyYZGE948h5OdZKkaCTwbSGuiOtnAAOgTQyz4i2GsBetn0uRP
37+
tIxA2godQqUSoNLAXfn/ZSavPLqXYC2pKD0H4GKV/weDXWZ7i2+3kpY+JN38XzIe
38+
3m+VP0xgElFbJBSdtwjAZNGeyCiXJoXdyVbMC5xaqUU4fmUw2UVPBQ==
39+
-----END RSA PRIVATE KEY-----

‎tests/saml/saml-decrypt.phpt

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
--TEST--
2+
Basic Decryption
3+
--FILE--
4+
<?php
5+
require(dirname(__FILE__) . '/../../xmlseclibs.php');
6+
use RobRichards\XMLSecLibs\XMLSecEnc;
7+
8+
/* When we need to locate our own key based on something like a key name */
9+
function locateLocalKey($objKey) {
10+
/* In this example the key is identified by filename */
11+
$filename = $objKey->name;
12+
if (! empty($filename)) {
13+
$objKey->loadKey(dirname(__FILE__) . "/$filename", TRUE);
14+
} else {
15+
$objKey->loadKey(dirname(__FILE__) . "/encryption_rsa.key", TRUE);
16+
}
17+
}
18+
19+
$testFile = "saml-encrypted.xml";
20+
21+
$output = NULL;
22+
23+
$doc = new DOMDocument();
24+
$doc->load(dirname(__FILE__) . "/$testFile");
25+
26+
try {
27+
$objenc = new XMLSecEnc();
28+
$encData = $objenc->locateEncryptedData($doc);
29+
if (! $encData) {
30+
throw new Exception("Cannot locate Encrypted Data");
31+
}
32+
$objenc->setNode($encData);
33+
$objenc->type = $encData->getAttribute("Type");
34+
if (! $objKey = $objenc->locateKey()) {
35+
throw new Exception("We know the secret key, but not the algorithm");
36+
}
37+
$key = NULL;
38+
39+
if ($objKeyInfo = $objenc->locateKeyInfo($objKey)) {
40+
if ($objKeyInfo->isEncrypted) {
41+
$objencKey = $objKeyInfo->encryptedCtx;
42+
locateLocalKey($objKeyInfo);
43+
$key = $objencKey->decryptKey($objKeyInfo);
44+
}
45+
}
46+
47+
if (! $objKey->key && empty($key)) {
48+
locateLocalKey($objKey);
49+
}
50+
if (empty($objKey->key)) {
51+
$objKey->loadKey($key);
52+
}
53+
54+
$token = NULL;
55+
56+
if ($decrypt = $objenc->decryptNode($objKey, TRUE)) {
57+
$output = NULL;
58+
59+
$xpath = new DOMXpath($decrypt->ownerDocument);
60+
$xpath->registerNamespace('saml2p', 'urn:oasis:names:tc:SAML:2.0:protocol');
61+
$xpath->registerNamespace('saml2', 'urn:oasis:names:tc:SAML:2.0:assertion');
62+
63+
$xpathQuery = 'string(/saml2p:Response/saml2:EncryptedAssertion/saml2:Assertion/saml2:AttributeStatement/saml2:Attribute/saml2:AttributeValue/saml2:NameID/text())';
64+
65+
$nameID = $xpath->evaluate($xpathQuery);
66+
67+
print "$nameID\n";
68+
69+
} else {
70+
throw new Exception("Unable to decrypt node");;
71+
}
72+
} catch (Exception $e) {
73+
var_dump($e);
74+
}
75+
76+
?>
77+
--EXPECTF--
78+
KYzsRqRzQY5qp+bv9T8bHA/AvsI=

0 commit comments

Comments
 (0)