10
10
11
11
class Encrypter implements EncrypterContract, StringEncrypter
12
12
{
13
- /**
14
- * The supported cipher algorithms and their properties.
15
- *
16
- * @var array
17
- */
18
- private static $ supportedCiphers = [
19
- 'AES-128-CBC ' => ['size ' => 16 , 'aead ' => false ],
20
- 'AES-256-CBC ' => ['size ' => 32 , 'aead ' => false ],
21
- 'AES-128-GCM ' => ['size ' => 16 , 'aead ' => true ],
22
- 'AES-256-GCM ' => ['size ' => 32 , 'aead ' => true ],
23
- ];
24
-
25
13
/**
26
14
* The encryption key.
27
15
*
@@ -36,6 +24,18 @@ class Encrypter implements EncrypterContract, StringEncrypter
36
24
*/
37
25
protected $ cipher ;
38
26
27
+ /**
28
+ * The supported cipher algorithms and their properties.
29
+ *
30
+ * @var array
31
+ */
32
+ private static $ supportedCiphers = [
33
+ 'AES-128-CBC ' => ['size ' => 16 , 'aead ' => false ],
34
+ 'AES-256-CBC ' => ['size ' => 32 , 'aead ' => false ],
35
+ 'AES-128-GCM ' => ['size ' => 16 , 'aead ' => true ],
36
+ 'AES-256-GCM ' => ['size ' => 32 , 'aead ' => true ],
37
+ ];
38
+
39
39
/**
40
40
* Create a new encrypter instance.
41
41
*
@@ -51,7 +51,8 @@ public function __construct($key, $cipher = 'AES-128-CBC')
51
51
52
52
if (! static ::supported ($ key , $ cipher )) {
53
53
$ ciphers = implode (', ' , array_keys (self ::$ supportedCiphers ));
54
- throw new RuntimeException ("Unsupported cipher or incorrect key length. Supported ciphers are: $ ciphers. " );
54
+
55
+ throw new RuntimeException ("Unsupported cipher or incorrect key length. Supported ciphers are: {$ ciphers }. " );
55
56
}
56
57
57
58
$ this ->key = $ key ;
@@ -98,9 +99,8 @@ public function encrypt($value, $serialize = true)
98
99
{
99
100
$ iv = random_bytes (openssl_cipher_iv_length ($ this ->cipher ));
100
101
101
- // A tag (mac) is returned by openssl_encrypt for AEAD ciphers.
102
- // Including $tag in the call for non-AEAD ciphers results in a warning before PHP 8.1.
103
102
$ tag = '' ;
103
+
104
104
$ value = self ::$ supportedCiphers [$ this ->cipher ]['aead ' ]
105
105
? \openssl_encrypt (
106
106
$ serialize ? serialize ($ value ) : $ value ,
@@ -119,10 +119,9 @@ public function encrypt($value, $serialize = true)
119
119
$ tag = base64_encode ($ tag );
120
120
121
121
$ mac = self ::$ supportedCiphers [$ this ->cipher ]['aead ' ]
122
- ? '' // For AEAD-algoritms, the tag/mac is returned by openssl_encrypt
122
+ ? '' // For AEAD-algoritms, the tag / MAC is returned by openssl_encrypt...
123
123
: $ this ->hash ($ iv , $ value );
124
124
125
- // Both tag and mac are included for compatibility reasons. A breaking update could use the same name for these.
126
125
$ json = json_encode (compact ('iv ' , 'value ' , 'mac ' , 'tag ' ), JSON_UNESCAPED_SLASHES );
127
126
128
127
if (json_last_error () !== JSON_ERROR_NONE ) {
@@ -220,7 +219,6 @@ protected function getJsonPayload($payload)
220
219
throw new DecryptException ('The payload is invalid. ' );
221
220
}
222
221
223
- // We only need to check for the valid MAC if a non-AEAD algorithm is used
224
222
if (! self ::$ supportedCiphers [$ this ->cipher ]['aead ' ] && ! $ this ->validMac ($ payload )) {
225
223
throw new DecryptException ('The MAC is invalid. ' );
226
224
}
0 commit comments