436
+ − 1
<?php
+ − 2
+ − 3
/*
+ − 4
* Enano - an open-source CMS capable of wiki functions, Drupal-like sidebar blocks, and everything in between
801
eb8b23f11744
Two big commits in one day I know, but redid password storage to use HMAC-SHA1. Consolidated much AES processing to three core methods in session that should handle everything automagically. Installation works; upgrades should. Rebranded as 1.1.6.
Dan
diff
changeset
+ − 5
* Version 1.1.6 (Caoineag beta 1)
536
+ − 6
* Copyright (C) 2006-2008 Dan Fuhry
436
+ − 7
* diffiehellman.php - Diffie Hellman key exchange and supporting functions
+ − 8
*
+ − 9
* This program is Free Software; you can redistribute and/or modify it under the terms of the GNU General Public License
+ − 10
* as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.
+ − 11
*
+ − 12
* This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied
+ − 13
* warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for details.
+ − 14
*/
+ − 15
+ − 16
/**
+ − 17
* The Diffie-Hellman key exchange protocol
+ − 18
*/
+ − 19
507
586fd7d3202d
Fixed some stray version numbers (again!); added support for Diffie-Hellman logins in the normal login form (not AJAX) - even works in IE
Dan
diff
changeset
+ − 20
global $dh_supported;
586fd7d3202d
Fixed some stray version numbers (again!); added support for Diffie-Hellman logins in the normal login form (not AJAX) - even works in IE
Dan
diff
changeset
+ − 21
$dh_supported = true;
586fd7d3202d
Fixed some stray version numbers (again!); added support for Diffie-Hellman logins in the normal login form (not AJAX) - even works in IE
Dan
diff
changeset
+ − 22
try
586fd7d3202d
Fixed some stray version numbers (again!); added support for Diffie-Hellman logins in the normal login form (not AJAX) - even works in IE
Dan
diff
changeset
+ − 23
{
586fd7d3202d
Fixed some stray version numbers (again!); added support for Diffie-Hellman logins in the normal login form (not AJAX) - even works in IE
Dan
diff
changeset
+ − 24
$GLOBALS['_math'] = enanomath_create();
586fd7d3202d
Fixed some stray version numbers (again!); added support for Diffie-Hellman logins in the normal login form (not AJAX) - even works in IE
Dan
diff
changeset
+ − 25
}
586fd7d3202d
Fixed some stray version numbers (again!); added support for Diffie-Hellman logins in the normal login form (not AJAX) - even works in IE
Dan
diff
changeset
+ − 26
catch ( Exception $e )
586fd7d3202d
Fixed some stray version numbers (again!); added support for Diffie-Hellman logins in the normal login form (not AJAX) - even works in IE
Dan
diff
changeset
+ − 27
{
586fd7d3202d
Fixed some stray version numbers (again!); added support for Diffie-Hellman logins in the normal login form (not AJAX) - even works in IE
Dan
diff
changeset
+ − 28
$dh_supported = false;
586fd7d3202d
Fixed some stray version numbers (again!); added support for Diffie-Hellman logins in the normal login form (not AJAX) - even works in IE
Dan
diff
changeset
+ − 29
}
436
+ − 30
// Our prime number as a base for operations.
712
+ − 31
$GLOBALS['dh_prime'] = '7916586051748534588306961133067968196965257961415756656521818848750723547477673457670019632882524164647651492025728980571833579341743988603191694784406703';
436
+ − 32
+ − 33
// g, a primitive root used as an exponent
+ − 34
// (2 and 5 are acceptable, but BigInt is faster with odd numbers)
+ − 35
$GLOBALS['dh_g'] = '5';
+ − 36
+ − 37
/**
+ − 38
* Generates a Diffie-Hellman private key
+ − 39
* @return string(BigInt)
+ − 40
*/
+ − 41
+ − 42
function dh_gen_private()
+ − 43
{
+ − 44
global $_math;
+ − 45
return $_math->random(256);
+ − 46
}
+ − 47
+ − 48
/**
+ − 49
* Calculates the public key from the private key
+ − 50
* @param string(BigInt)
+ − 51
* @return string(BigInt)
+ − 52
*/
+ − 53
+ − 54
function dh_gen_public($b)
+ − 55
{
+ − 56
global $_math, $dh_g, $dh_prime;
+ − 57
return $_math->powmod($dh_g, $b, $dh_prime);
+ − 58
}
+ − 59
+ − 60
/**
+ − 61
* Calculates the shared secret.
+ − 62
* @param string(BigInt) Our private key
+ − 63
* @param string(BigInt) Remote party's public key
+ − 64
* @return string(BigInt)
+ − 65
*/
+ − 66
+ − 67
function dh_gen_shared_secret($a, $B)
+ − 68
{
+ − 69
global $_math, $dh_g, $dh_prime;
+ − 70
return $_math->powmod($B, $a, $dh_prime);
+ − 71
}
+ − 72
+ − 73
/*
+ − 74
SHA-256 algorithm - ported from Javascript
+ − 75
+ − 76
Copyright (c) 2003-2004, Angel Marin
+ − 77
All rights reserved.
+ − 78
Portions copyright (c) 2008 Dan Fuhry.
+ − 79
+ − 80
Redistribution and use in source and binary forms, with or without modification,
+ − 81
are permitted provided that the following conditions are met:
+ − 82
+ − 83
* Redistributions of source code must retain the above copyright notice, this
+ − 84
list of conditions and the following disclaimer.
+ − 85
* Redistributions in binary form must reproduce the above copyright notice,
+ − 86
this list of conditions and the following disclaimer in the documentation
+ − 87
and/or other materials provided with the distribution.
+ − 88
* Neither the name of the <ORGANIZATION> nor the names of its contributors may
+ − 89
be used to endorse or promote products derived from this software without
+ − 90
specific prior written permission.
+ − 91
+ − 92
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ − 93
ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ − 94
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ − 95
IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
+ − 96
INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ − 97
BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ − 98
DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+ − 99
LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
+ − 100
OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ − 101
OF THE POSSIBILITY OF SUCH DAMAGE.
+ − 102
*/
+ − 103
class SHA256
+ − 104
{
+ − 105
var $chrsz = 8; /* bits per input character. 8 - ASCII; 16 - Unicode */
+ − 106
+ − 107
function safe_add ($x, $y) {
+ − 108
$lsw = ($x & 0xFFFF) + ($y & 0xFFFF);
+ − 109
$msw = ($x >> 16) + ($y >> 16) + ($lsw >> 16);
+ − 110
return ($msw << 16) | ($lsw & 0xFFFF);
+ − 111
}
+ − 112
function rshz($X, $n)
+ − 113
{
+ − 114
// equivalent to $X >>> $n in javascript
+ − 115
// pulled from http://www.tapouillo.com/firefox_extension/sourcecode.txt, public domain
+ − 116
$z = hexdec(80000000);
+ − 117
if ($z & $X)
+ − 118
{
+ − 119
$X = ($X>>1);
+ − 120
$X &= (~$z);
+ − 121
$X |= 0x40000000;
+ − 122
$X = ($X>>($n-1));
+ − 123
}
+ − 124
else
+ − 125
{
+ − 126
$X = ($X>>$n);
+ − 127
}
+ − 128
return $X;
+ − 129
}
+ − 130
function S ($X, $n) {return ( $this->rshz($X, $n) ) | ($X << (32 - $n));}
+ − 131
function R ($X, $n) {return ( $this->rshz($X, $n) );}
+ − 132
function Ch($x, $y, $z) {return (($x & $y) ^ ((~$x) & $z));}
+ − 133
function Maj($x, $y, $z) {return (($x & $y) ^ ($x & $z) ^ ($y & $z));}
+ − 134
function Sigma0256($x) {return ($this->S($x, 2) ^ $this->S($x, 13) ^ $this->S($x, 22));}
+ − 135
function Sigma1256($x) {return ($this->S($x, 6) ^ $this->S($x, 11) ^ $this->S($x, 25));}
+ − 136
function Gamma0256($x) {return ($this->S($x, 7) ^ $this->S($x, 18) ^ $this->R($x, 3));}
+ − 137
function Gamma1256($x) {return ($this->S($x, 17) ^ $this->S($x, 19) ^ $this->R($x, 10));}
+ − 138
function core_sha256 ($m, $l) {
+ − 139
$K = Array(0x428A2F98,0x71374491,0xB5C0FBCF,0xE9B5DBA5,0x3956C25B,0x59F111F1,0x923F82A4,0xAB1C5ED5,0xD807AA98,0x12835B01,0x243185BE,0x550C7DC3,0x72BE5D74,0x80DEB1FE,0x9BDC06A7,0xC19BF174,0xE49B69C1,0xEFBE4786,0xFC19DC6,0x240CA1CC,0x2DE92C6F,0x4A7484AA,0x5CB0A9DC,0x76F988DA,0x983E5152,0xA831C66D,0xB00327C8,0xBF597FC7,0xC6E00BF3,0xD5A79147,0x6CA6351,0x14292967,0x27B70A85,0x2E1B2138,0x4D2C6DFC,0x53380D13,0x650A7354,0x766A0ABB,0x81C2C92E,0x92722C85,0xA2BFE8A1,0xA81A664B,0xC24B8B70,0xC76C51A3,0xD192E819,0xD6990624,0xF40E3585,0x106AA070,0x19A4C116,0x1E376C08,0x2748774C,0x34B0BCB5,0x391C0CB3,0x4ED8AA4A,0x5B9CCA4F,0x682E6FF3,0x748F82EE,0x78A5636F,0x84C87814,0x8CC70208,0x90BEFFFA,0xA4506CEB,0xBEF9A3F7,0xC67178F2);
+ − 140
$HASH = Array(0x6A09E667, 0xBB67AE85, 0x3C6EF372, 0xA54FF53A, 0x510E527F, 0x9B05688C, 0x1F83D9AB, 0x5BE0CD19);
+ − 141
$W = Array(64);
+ − 142
/* append padding */
+ − 143
$m[$l >> 5] |= 0x80 << (24 - $l % 32);
+ − 144
$m[(($l + 64 >> 9) << 4) + 15] = $l;
+ − 145
for ( $i = 0; $i<count($m); $i+=16 ) {
+ − 146
$a = $HASH[0];
+ − 147
$b = $HASH[1];
+ − 148
$c = $HASH[2];
+ − 149
$d = $HASH[3];
+ − 150
$e = $HASH[4];
+ − 151
$f = $HASH[5];
+ − 152
$g = $HASH[6];
+ − 153
$h = $HASH[7];
+ − 154
for ( $j = 0; $j<64; $j++)
+ − 155
{
+ − 156
if ( $j < 16 )
+ − 157
{
+ − 158
$W[$j] = ( isset($m[$j + $i]) ) ? $m[$j + $i] : 0;
+ − 159
}
+ − 160
else
+ − 161
{
+ − 162
$W[$j] = $this->safe_add(
+ − 163
$this->safe_add(
+ − 164
$this->safe_add(
+ − 165
$this->Gamma1256($W[$j - 2]), $W[$j - 7]),
+ − 166
$this->Gamma0256($W[$j - 15])),
+ − 167
$W[$j - 16]);
+ − 168
}
+ − 169
$T1 = $this->safe_add(
+ − 170
$this->safe_add(
+ − 171
$this->safe_add(
+ − 172
$this->safe_add($h, $this->Sigma1256($e)
+ − 173
),
+ − 174
$this->Ch($e, $f, $g)),
+ − 175
$K[$j]),
+ − 176
$W[$j]);
+ − 177
$T2 = $this->safe_add($this->Sigma0256($a), $this->Maj($a, $b, $c));
+ − 178
$h = $g;
+ − 179
$g = $f;
+ − 180
$f = $e;
+ − 181
$e = $this->safe_add($d, $T1);
+ − 182
$d = $c;
+ − 183
$c = $b;
+ − 184
$b = $a;
+ − 185
$a = $this->safe_add($T1, $T2);
+ − 186
}
+ − 187
$HASH[0] = $this->safe_add($a, $HASH[0]);
+ − 188
$HASH[1] = $this->safe_add($b, $HASH[1]);
+ − 189
$HASH[2] = $this->safe_add($c, $HASH[2]);
+ − 190
$HASH[3] = $this->safe_add($d, $HASH[3]);
+ − 191
$HASH[4] = $this->safe_add($e, $HASH[4]);
+ − 192
$HASH[5] = $this->safe_add($f, $HASH[5]);
+ − 193
$HASH[6] = $this->safe_add($g, $HASH[6]);
+ − 194
$HASH[7] = $this->safe_add($h, $HASH[7]);
+ − 195
}
+ − 196
return $HASH;
+ − 197
}
+ − 198
function str2binb ($str) {
+ − 199
$bin = Array();
+ − 200
for ( $i = 0; $i < strlen($str); $i++ )
+ − 201
{
+ − 202
$byte = ord($str{$i});
+ − 203
$block = floor($i / 4);
+ − 204
$stage = $i % 4;
+ − 205
if ( $stage == 0 )
+ − 206
{
+ − 207
$bin[$block] = $byte;
+ − 208
}
+ − 209
else
+ − 210
{
+ − 211
$bin[$block] <<= 8;
+ − 212
$bin[$block] |= $byte;
+ − 213
}
+ − 214
}
+ − 215
while ( $stage < 3 )
+ − 216
{
+ − 217
$stage++;
+ − 218
$bin[$block] <<= 8;
+ − 219
}
+ − 220
return $bin;
+ − 221
}
+ − 222
function byte2hex($byte)
+ − 223
{
+ − 224
$b = dechex(ord($byte));
+ − 225
return ( strlen($b) < 2 ) ? "0$b" : $b;
+ − 226
}
+ − 227
function binb2hex ($binarray) {
+ − 228
$hexcase = 0; /* hex output format. 0 - lowercase; 1 - uppercase */
+ − 229
$hex_tab = $hexcase ? "0123456789ABCDEF" : "0123456789abcdef";
+ − 230
$str = "";
+ − 231
foreach ( $binarray as $bytes )
+ − 232
{
+ − 233
$str .= implode('', array(
+ − 234
$this->byte2hex(chr(( $bytes >> 24 ) & 0xFF)),
+ − 235
$this->byte2hex(chr(( $bytes >> 16 ) & 0xFF)),
+ − 236
$this->byte2hex(chr(( $bytes >> 8 ) & 0xFF)),
+ − 237
$this->byte2hex(chr($bytes & 0xFF))
+ − 238
));
+ − 239
}
+ − 240
return $str;
+ − 241
}
+ − 242
function hex_sha256 ( $s )
+ − 243
{
+ − 244
return $this->binb2hex(
+ − 245
$this->core_sha256(
+ − 246
$this->str2binb($s),
+ − 247
strlen($s) * $this->chrsz)
+ − 248
);
+ − 249
}
+ − 250
}
+ − 251
+ − 252
if ( !function_exists('sha256') )
+ − 253
{
+ − 254
function sha256($text)
+ − 255
{
+ − 256
static $sha_obj = false;
+ − 257
if ( !is_object($sha_obj) )
+ − 258
$sha_obj = new SHA256();
+ − 259
return $sha_obj->hex_sha256($text);
+ − 260
}
+ − 261
}
+ − 262
+ − 263
?>