dragonrun1 / encryption-helper Goto Github PK

• encryption-helper/src/EncryptionHelper.php

  Line 220 in add0c21

  if ($checksum === null || $checksum !== $this->computedCheckSum()) {

• encryption-helper/src/EncryptionHelper.php

  Lines 345 to 363 in add0c21

  	/**
  	* Used to create and validate query checksum value.
  	*
  	* @return string
  	*/
  	private function computedCheckSum(): string
  	{
  	$checksum = 0;
  	$zero = ord('0');
  	$func = function ($acc = 0, $value) use ($zero) {
  	foreach (str_split($value) as $item) {
  	$acc += ord($item) - $zero;
  	}
  	return $acc;
  	};
  	$checksum += array_reduce(array_keys($this->queries), $func);
  	$checksum += array_reduce($this->queries, $func);
  	return sprintf('%X', $checksum);
  	}

  • This checksum is not a secure message authenticator (e.g. HMAC-SHA256, Poly1305), particularly because it doesn't have any secret keys.

• encryption-helper/src/EncryptionHelper.php

  Line 438 in add0c21

  private $cipher = 'DES-CBC';

  • DES-CBC is not secure. Use something secure.

• encryption-helper/src/EncryptionHelper.php

  Lines 137 to 138 in add0c21

  	$decrypted = openssl_decrypt($this->getBytes($data), $this->cipher, $this->getKey(),
  	OPENSSL_RAW_DATA | OPENSSL_ZERO_PADDING, $this->getInitVector());

When you combine these snippets together, you get a situation that looks like this:

1. You're encrypting by default with DES, which can be brute-forced in a day's time.
2. You're using unauthenticated encryption.
3. You're using it to encrypt URL parameters, which is a questionable solution to begin with.