[smarcet]

* fixed private keys with passwords

Author: smarcet

src/jwa/cryptographic_algorithms/digital_signatures/rsa/RSA_Algorithm.php

@@ -44,9 +44,14 @@ public function sign(PrivateKey $private_key, $message)
         if($this->getMinKeyLen() > $private_key->getBitLength())
             throw new InvalidKeyLengthAlgorithmException(sprintf('min len %s - cur len %s.',$this->getMinKeyLen(), $private_key->getBitLength()));
 
+        if($private_key->hasPassword()){
+            $this->rsa_impl->setPassword($private_key->getPassword());
+        }
+
         $res = $this->rsa_impl->loadKey($private_key->getEncoded());
 
-        if(!$res) throw new InvalidKeyTypeAlgorithmException;
+        if(!$res)
+            throw new InvalidKeyTypeAlgorithmException;
 
         $this->rsa_impl->setHash($this->getHashingAlgorithm());
         $this->rsa_impl->setMGFHash($this->getHashingAlgorithm());

src/jwe/impl/_ContentEncryptionKey.php

@@ -77,4 +77,12 @@ public function getBitLength()
     {
        return ByteUtil::bitLength(strlen($this->value));
     }
+
+    /**
+     * @return string
+     */
+    public function getStrippedEncoded(): string
+    {
+       return $this->getEncoded();
+    }
 }

src/jwk/impl/AsymmetricJWK.php

@@ -49,7 +49,7 @@ abstract class AsymmetricJWK
     /**
      * @var X509Certificate[]
      */
-    protected $x509_certificates_chain = array();
+    protected $x509_certificates_chain = [];
 
     /**
      * @param array $headers
@@ -66,8 +66,7 @@ protected function __construct(array $headers = array())
 
             // json array
             foreach($headers[PublicJSONWebKeyParameters::X_509CertificateChain] as $x509_pem){
-                array_push($this->x509_certificates_chain, X509CertificateFactory::buildFromPEM($x509_pem));
-
+                $this->x509_certificates_chain[] =  X509CertificateFactory::buildFromPEM($x509_pem);
             }
 
             if($this->checkX509CertMismatch()){
@@ -188,7 +187,7 @@ public function getX509Url()
      */
     protected function checkX509CertMismatch(){
         $x509 = $this->getX509LeafCertificate();
-        return !is_null($x509) && $x509->getPublicKey() !== $this->public_key->getEncoded();
+        return !is_null($x509) && $x509->getPublicKey() !== $this->public_key->getStrippedEncoded();
     }
 
     /**

src/jwk/impl/OctetSequenceJWK.php

@@ -48,7 +48,7 @@ protected function __construct(Key $secret, $headers = array())
 
         $this->key = $secret;
 
-        $this->set[OctetSequenceKeysParameters::Key] = new StringOrURI($b64->encode($secret->getEncoded()));
+        $this->set[OctetSequenceKeysParameters::Key] = new StringOrURI($b64->encode($secret->getStrippedEncoded()));
 
     }
 

src/security/Key.php

@@ -13,7 +13,6 @@
  **/
 
 
-
 /**
  * Interface Key
  * @package security
@@ -30,6 +29,11 @@ public function getAlgorithm();
      */
     public function getEncoded();
 
+    /**
+     * @return string
+     */
+    public function getStrippedEncoded():string;
+
     /**
      * @return string
      */
@@ -39,4 +43,5 @@ public function getFormat();
      * @return int
      */
     public function getBitLength();
+
 }

src/security/KeyWithPassword.php

@@ -0,0 +1,30 @@
+<?php namespace security;
+/**
+ * Copyright 2019 OpenStack Foundation
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * http://www.apache.org/licenses/LICENSE-2.0
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ **/
+
+/**
+ * Interface KeyWithPassword
+ * @package security
+ */
+interface KeyWithPassword extends Key
+{
+    /**
+     * @return null|string
+     */
+    public function getPassword():?string;
+
+    /**
+     * @return bool
+     */
+    public function hasPassword():bool;
+}

src/security/PrivateKey.php

@@ -13,7 +13,7 @@
  **/
 
 /**
- * Interface PrivateKey
+ * Interface PrivateKeyPrivateKey
  * @package security
  */
 interface PrivateKey extends Key {

src/security/SymmetricSharedKey.php

@@ -68,4 +68,12 @@ public function getSecret()
     {
        return $this->secret;
     }
+
+    /**
+     * @return string
+     */
+    public function getStrippedEncoded(): string
+    {
+        return $this->getEncoded();
+    }
 }

src/security/rsa/RSAFacade.php

@@ -56,7 +56,7 @@ public function buildKeyPair($bits){
         $this->rsa_imp->setPublicKeyFormat(RSA::PUBLIC_FORMAT_PKCS1);
 
         $list = $this->rsa_imp->createKey($bits);
-        return new KeyPair( new _RSAPublicKeyPEMFornat($list['publickey']), new _RSAPrivateKeyPEMFornat($list['privatekey']));
+        return new KeyPair( new _RSAPublicKeyPEMFormat($list['publickey']), new _RSAPrivateKeyPEMFormat($list['privatekey']));
     }
 
     /**
@@ -66,7 +66,7 @@ public function buildKeyPair($bits){
      */
     public function buildPublicKey(BigInteger $n, BigInteger $e){
         $public_key_pem = $this->rsa_imp->_convertPublicKey($n, $e);
-        return new _RSAPublicKeyPEMFornat($public_key_pem);
+        return new _RSAPublicKeyPEMFormat($public_key_pem);
     }
 
     /**
@@ -78,7 +78,7 @@ public function buildMinimalPrivateKey(\Math_BigInteger $n, \Math_BigInteger $d)
         $this->rsa_imp->modulus = $n;
         $this->rsa_imp->exponent = $d;
         $private_key_pem = $this->rsa_imp->_getPrivatePublicKey();
-        return new _RSAPrivateKeyPEMFornat($private_key_pem);
+        return new _RSAPrivateKeyPEMFormat($private_key_pem);
     }
 
     /**
@@ -109,7 +109,7 @@ public function buildPrivateKey(BigInteger $n,
             array($dp, $dq),
             array($qi, $qi)
         );
-        return new _RSAPrivateKeyPEMFornat($private_key_pem);
+        return new _RSAPrivateKeyPEMFormat($private_key_pem);
     }
 
     /**
@@ -119,7 +119,7 @@ public function buildPrivateKey(BigInteger $n,
      * @throws RSABadPEMFormat
      */
     public function buildPrivateKeyFromPEM($private_key_pem, $password = null){
-       return new _RSAPrivateKeyPEMFornat($private_key_pem, $password);
+       return new _RSAPrivateKeyPEMFormat($private_key_pem, $password);
     }
 
     /**
@@ -128,7 +128,7 @@ public function buildPrivateKeyFromPEM($private_key_pem, $password = null){
      * @throws RSABadPEMFormat
      */
     public function buildPublicKeyFromPEM($public_key_pem){
-        return new _RSAPublicKeyPEMFornat($public_key_pem);
+        return new _RSAPublicKeyPEMFormat($public_key_pem);
     }
 
 }

src/security/rsa/RSAPrivateKey.php

@@ -11,13 +11,14 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  **/
+use security\KeyWithPassword;
 use security\PrivateKey;
 use phpseclib\Math\BigInteger;
 /**
  * Interface RSAPrivateKey
  * @package security\rsa
  */
-interface RSAPrivateKey extends RSAPublicKey, PrivateKey {
+interface RSAPrivateKey extends RSAPublicKey, PrivateKey, KeyWithPassword {
 
     /**
      * The "d" (private exponent)