Merge pull request #400 from web-token/3.1.x-merge-up-into-4.0.x_xA3loUDE

Spomky · web-flow · commit 2bc3779db173 · 2022-08-30T13:38:43.000+02:00
Merge release 3.1.1 into 4.0.x
diff --git a/src/Component/Console/AddKeyIntoKeysetCommand.php b/src/Component/Console/AddKeyIntoKeysetCommand.php
@@ -15,7 +15,7 @@
 use Symfony\Component\Console\Input\InputInterface;
 use Symfony\Component\Console\Output\OutputInterface;
 
-#[AsCommand(name: 'keyset:add:key', description: 'Add a key into a key set.',)]
+#[AsCommand(name: 'keyset:add:key', description: 'Add a key into a key set.')]
 final class AddKeyIntoKeysetCommand extends ObjectOutputCommand
 {
     protected function configure(): void
diff --git a/src/Component/Console/EcKeyGeneratorCommand.php b/src/Component/Console/EcKeyGeneratorCommand.php
@@ -12,7 +12,7 @@
 use Symfony\Component\Console\Input\InputInterface;
 use Symfony\Component\Console\Output\OutputInterface;
 
-#[AsCommand(name: 'key:generate:ec', description: 'Generate an EC key (JWK format)',)]
+#[AsCommand(name: 'key:generate:ec', description: 'Generate an EC key (JWK format)')]
 final class EcKeyGeneratorCommand extends GeneratorCommand
 {
     protected function configure(): void
diff --git a/src/Component/Console/EcKeysetGeneratorCommand.php b/src/Component/Console/EcKeysetGeneratorCommand.php
@@ -13,7 +13,7 @@
 use Symfony\Component\Console\Input\InputInterface;
 use Symfony\Component\Console\Output\OutputInterface;
 
-#[AsCommand(name: 'keyset:generate:ec', description: 'Generate an EC key set (JWKSet format)',)]
+#[AsCommand(name: 'keyset:generate:ec', description: 'Generate an EC key set (JWKSet format)')]
 final class EcKeysetGeneratorCommand extends GeneratorCommand
 {
     protected function configure(): void
diff --git a/src/Component/Console/GetThumbprintCommand.php b/src/Component/Console/GetThumbprintCommand.php
@@ -15,7 +15,7 @@
 use Symfony\Component\Console\Input\InputOption;
 use Symfony\Component\Console\Output\OutputInterface;
 
-#[AsCommand(name: 'key:thumbprint', description: 'Get the thumbprint of a JWK key.',)]
+#[AsCommand(name: 'key:thumbprint', description: 'Get the thumbprint of a JWK key.')]
 final class GetThumbprintCommand extends ObjectOutputCommand
 {
     protected function configure(): void
diff --git a/src/Component/Console/JKULoaderCommand.php b/src/Component/Console/JKULoaderCommand.php
@@ -12,7 +12,7 @@
 use Symfony\Component\Console\Input\InputInterface;
 use Symfony\Component\Console\Output\OutputInterface;
 
-#[AsCommand(name: 'keyset:load:jku', description: 'Loads a key set from an url.',)]
+#[AsCommand(name: 'keyset:load:jku', description: 'Loads a key set from an url.')]
 final class JKULoaderCommand extends ObjectOutputCommand
 {
     public function __construct(
diff --git a/src/Component/Console/KeyAnalyzerCommand.php b/src/Component/Console/KeyAnalyzerCommand.php
@@ -17,7 +17,7 @@
 use Symfony\Component\Console\Input\InputInterface;
 use Symfony\Component\Console\Output\OutputInterface;
 
-#[AsCommand(name: 'key:analyze', description: 'JWK quality analyzer.',)]
+#[AsCommand(name: 'key:analyze', description: 'JWK quality analyzer.')]
 final class KeyAnalyzerCommand extends Command
 {
     public function __construct(
diff --git a/src/Component/Console/KeyFileLoaderCommand.php b/src/Component/Console/KeyFileLoaderCommand.php
@@ -13,7 +13,7 @@
 use Symfony\Component\Console\Input\InputOption;
 use Symfony\Component\Console\Output\OutputInterface;
 
-#[AsCommand(name: 'key:load:key', description: 'Loads a key from a key file (JWK format)',)]
+#[AsCommand(name: 'key:load:key', description: 'Loads a key from a key file (JWK format)')]
 final class KeyFileLoaderCommand extends GeneratorCommand
 {
     protected function configure(): void
diff --git a/src/Component/Console/KeysetAnalyzerCommand.php b/src/Component/Console/KeysetAnalyzerCommand.php
@@ -19,13 +19,12 @@
 use Symfony\Component\Console\Input\InputInterface;
 use Symfony\Component\Console\Output\OutputInterface;
 
-#[AsCommand(name: 'keyset:analyze', description: 'JWKSet quality analyzer.',)]
+#[AsCommand(name: 'keyset:analyze', description: 'JWKSet quality analyzer.')]
 final class KeysetAnalyzerCommand extends Command
 {
     public function __construct(
         private readonly KeysetAnalyzerManager $keysetAnalyzerManager,
-        private readonly KeyAnalyzerManager $keyAnalyzerManager,
-        string $name = null
+        private readonly KeyAnalyzerManager $keyAnalyzerManager
     ) {
         parent::__construct();
     }
diff --git a/src/Component/Console/MergeKeysetCommand.php b/src/Component/Console/MergeKeysetCommand.php
@@ -13,7 +13,7 @@
 use Symfony\Component\Console\Input\InputInterface;
 use Symfony\Component\Console\Output\OutputInterface;
 
-#[AsCommand(name: 'keyset:merge', description: 'Merge several key sets into one.',)]
+#[AsCommand(name: 'keyset:merge', description: 'Merge several key sets into one.')]
 final class MergeKeysetCommand extends ObjectOutputCommand
 {
     protected function configure(): void
diff --git a/src/Component/Console/OctKeyGeneratorCommand.php b/src/Component/Console/OctKeyGeneratorCommand.php
@@ -11,7 +11,7 @@
 use Symfony\Component\Console\Input\InputInterface;
 use Symfony\Component\Console\Output\OutputInterface;
 
-#[AsCommand(name: 'key:generate:oct', description: 'Generate an octet key (JWK format)',)]
+#[AsCommand(name: 'key:generate:oct', description: 'Generate an octet key (JWK format)')]
 final class OctKeyGeneratorCommand extends GeneratorCommand
 {
     protected function configure(): void
diff --git a/src/Component/Console/OctKeysetGeneratorCommand.php b/src/Component/Console/OctKeysetGeneratorCommand.php
@@ -12,7 +12,7 @@
 use Symfony\Component\Console\Input\InputInterface;
 use Symfony\Component\Console\Output\OutputInterface;
 
-#[AsCommand(name: 'keyset:generate:oct', description: 'Generate a key set with octet keys (JWK format)',)]
+#[AsCommand(name: 'keyset:generate:oct', description: 'Generate a key set with octet keys (JWK format)')]
 final class OctKeysetGeneratorCommand extends GeneratorCommand
 {
     protected function configure(): void
diff --git a/src/Component/Console/OkpKeyGeneratorCommand.php b/src/Component/Console/OkpKeyGeneratorCommand.php
@@ -12,7 +12,7 @@
 use Symfony\Component\Console\Input\InputInterface;
 use Symfony\Component\Console\Output\OutputInterface;
 
-#[AsCommand(name: 'key:generate:okp', description: 'Generate an Octet Key Pair key (JWK format)',)]
+#[AsCommand(name: 'key:generate:okp', description: 'Generate an Octet Key Pair key (JWK format)')]
 final class OkpKeyGeneratorCommand extends GeneratorCommand
 {
     protected function configure(): void
diff --git a/src/Component/Console/OptimizeRsaKeyCommand.php b/src/Component/Console/OptimizeRsaKeyCommand.php
@@ -15,7 +15,7 @@
 use Symfony\Component\Console\Input\InputInterface;
 use Symfony\Component\Console\Output\OutputInterface;
 
-#[AsCommand(name: 'key:optimize', description: 'Optimize a RSA key by calculating additional primes (CRT).',)]
+#[AsCommand(name: 'key:optimize', description: 'Optimize a RSA key by calculating additional primes (CRT).')]
 final class OptimizeRsaKeyCommand extends ObjectOutputCommand
 {
     protected function configure(): void
diff --git a/src/Component/Console/P12CertificateLoaderCommand.php b/src/Component/Console/P12CertificateLoaderCommand.php
@@ -13,7 +13,7 @@
 use Symfony\Component\Console\Input\InputOption;
 use Symfony\Component\Console\Output\OutputInterface;
 
-#[AsCommand(name: 'key:load:p12', description: 'Load a key from a P12 certificate file.',)]
+#[AsCommand(name: 'key:load:p12', description: 'Load a key from a P12 certificate file.')]
 final class P12CertificateLoaderCommand extends GeneratorCommand
 {
     protected function configure(): void
diff --git a/src/Component/Console/PemConverterCommand.php b/src/Component/Console/PemConverterCommand.php
@@ -16,7 +16,7 @@
 use Symfony\Component\Console\Input\InputInterface;
 use Symfony\Component\Console\Output\OutputInterface;
 
-#[AsCommand(name: 'key:convert:pkcs1', description: 'Converts a RSA or EC key into PKCS#1 key.',)]
+#[AsCommand(name: 'key:convert:pkcs1', description: 'Converts a RSA or EC key into PKCS#1 key.')]
 final class PemConverterCommand extends ObjectOutputCommand
 {
     protected function configure(): void
diff --git a/src/Component/Console/RotateKeysetCommand.php b/src/Component/Console/RotateKeysetCommand.php
@@ -16,7 +16,7 @@
 use Symfony\Component\Console\Input\InputInterface;
 use Symfony\Component\Console\Output\OutputInterface;
 
-#[AsCommand(name: 'keyset:rotate', description: 'Rotate a key set.',)]
+#[AsCommand(name: 'keyset:rotate', description: 'Rotate a key set.')]
 final class RotateKeysetCommand extends ObjectOutputCommand
 {
     protected function configure(): void
diff --git a/src/Component/Console/RsaKeyGeneratorCommand.php b/src/Component/Console/RsaKeyGeneratorCommand.php
@@ -11,7 +11,7 @@
 use Symfony\Component\Console\Input\InputInterface;
 use Symfony\Component\Console\Output\OutputInterface;
 
-#[AsCommand(name: 'key:generate:rsa', description: 'Generate a RSA key (JWK format)',)]
+#[AsCommand(name: 'key:generate:rsa', description: 'Generate a RSA key (JWK format)')]
 final class RsaKeyGeneratorCommand extends GeneratorCommand
 {
     protected function configure(): void
diff --git a/src/Component/Console/RsaKeysetGeneratorCommand.php b/src/Component/Console/RsaKeysetGeneratorCommand.php
@@ -12,7 +12,7 @@
 use Symfony\Component\Console\Input\InputInterface;
 use Symfony\Component\Console\Output\OutputInterface;
 
-#[AsCommand(name: 'keyset:generate:rsa', description: 'Generate a key set with RSA keys (JWK format)',)]
+#[AsCommand(name: 'keyset:generate:rsa', description: 'Generate a key set with RSA keys (JWK format)')]
 final class RsaKeysetGeneratorCommand extends GeneratorCommand
 {
     protected function configure(): void
diff --git a/src/Component/Console/X509CertificateLoaderCommand.php b/src/Component/Console/X509CertificateLoaderCommand.php
@@ -12,7 +12,7 @@
 use Symfony\Component\Console\Input\InputInterface;
 use Symfony\Component\Console\Output\OutputInterface;
 
-#[AsCommand(name: 'key:load:x509', description: 'Load a key from a X.509 certificate file.',)]
+#[AsCommand(name: 'key:load:x509', description: 'Load a key from a X.509 certificate file.')]
 final class X509CertificateLoaderCommand extends GeneratorCommand
 {
     protected function configure(): void
diff --git a/src/Component/Console/X5ULoaderCommand.php b/src/Component/Console/X5ULoaderCommand.php
@@ -12,12 +12,11 @@
 use Symfony\Component\Console\Input\InputInterface;
 use Symfony\Component\Console\Output\OutputInterface;
 
-#[AsCommand(name: 'keyset:load:x5u', description: 'Loads a key set from an url.',)]
+#[AsCommand(name: 'keyset:load:x5u', description: 'Loads a key set from an url.')]
 final class X5ULoaderCommand extends ObjectOutputCommand
 {
     public function __construct(
-        private readonly X5UFactory $x5uFactory,
-        ?string $name = null
+        private readonly X5UFactory $x5uFactory
     ) {
         parent::__construct();
     }
diff --git a/src/Component/KeyManagement/JWKFactory.php b/src/Component/KeyManagement/JWKFactory.php
@@ -106,23 +106,23 @@ public static function createOKPKey(string $curve, array $values = []): JWK
         switch ($curve) {
             case 'X25519':
                 $keyPair = sodium_crypto_box_keypair();
-                $secret = $keyPair;
+                $d = sodium_crypto_box_secretkey($keyPair);
                 $x = sodium_crypto_box_publickey($keyPair);
 
                 break;
 
             case 'Ed25519':
                 $keyPair = sodium_crypto_sign_keypair();
                 $secret = sodium_crypto_sign_secretkey($keyPair);
+                $secretLength = mb_strlen($secret, '8bit');
+                $d = mb_substr($secret, 0, -$secretLength / 2, '8bit');
                 $x = sodium_crypto_sign_publickey($keyPair);
 
                 break;
 
             default:
                 throw new InvalidArgumentException(sprintf('Unsupported "%s" curve', $curve));
         }
-        $secretLength = mb_strlen($secret, '8bit');
-        $d = mb_substr($secret, 0, -$secretLength / 2, '8bit');
 
         $values = array_merge(
             $values,
diff --git a/src/EncryptionAlgorithm/KeyEncryption/ECDHES/AbstractECDH.php b/src/EncryptionAlgorithm/KeyEncryption/ECDHES/AbstractECDH.php
@@ -293,7 +293,9 @@ private function createOKPKey(string $curve): JWK
 
             case 'Ed25519':
                 $keyPair = sodium_crypto_sign_keypair();
-                $d = sodium_crypto_sign_secretkey($keyPair);
+                $secret = sodium_crypto_sign_secretkey($keyPair);
+                $secretLength = mb_strlen($secret, '8bit');
+                $d = mb_substr($secret, 0, -$secretLength / 2, '8bit');
                 $x = sodium_crypto_sign_publickey($keyPair);
 
                 break;
diff --git a/tests/EncryptionAlgorithm/KeyEncryption/ECDHES/ECDHESKeyAgreementTest.php b/tests/EncryptionAlgorithm/KeyEncryption/ECDHES/ECDHESKeyAgreementTest.php
@@ -26,7 +26,7 @@ final class ECDHESKeyAgreementTest extends TestCase
      *
      * @test
      */
-    public function getAgreementKey(): void
+    public function getAgreementKeyWithEllipticCurveKey(): void
     {
         $receiver = new JWK([
             'kty' => 'EC',
@@ -51,6 +51,76 @@ public function getAgreementKey(): void
         static::assertArrayHasKey('y', $additional_header_values['epk']);
     }
 
+    /**
+     * @see https://tools.ietf.org/html/rfc7518#appendix-C
+     *
+     * @test
+     */
+    public function getAgreementKeyWithA128KeyWrapAndWithOctetKeyPairKey(): void
+    {
+        $header = [
+            'enc' => 'A128GCM',
+        ];
+
+        $private = new JWK([
+            'kty' => 'OKP',
+            'crv' => 'X25519',
+            'd' => 'uns2Byv3po_cjjG8XRCtU-lEOrOgLbsDr5cXHmgjVvA',
+            'x' => 'k8IkMMO9I0foCYqEcbfM49DjEoWpHdho_GKNMXk1rFw',
+        ]);
+        $public = $private->toPublic();
+
+        $cek = [
+            4,
+            211,
+            31,
+            197,
+            84,
+            157,
+            252,
+            254,
+            11,
+            100,
+            157,
+            250,
+            63,
+            170,
+            106,
+            206,
+            107,
+            124,
+            212,
+            45,
+            111,
+            107,
+            9,
+            219,
+            200,
+            177,
+            0,
+            240,
+            143,
+            156,
+            44,
+            207,
+        ];
+        foreach ($cek as $key => $value) {
+            $cek[$key] = str_pad(dechex($value), 2, '0', STR_PAD_LEFT);
+        }
+        $cek = hex2bin(implode('', $cek));
+
+        $ecdh_es = new ECDHESA128KW();
+        $encrypted_cek = $ecdh_es->wrapAgreementKey($public, null, $cek, 128, $header, $header);
+        static::assertArrayHasKey('epk', $header);
+        static::assertArrayHasKey('crv', $header['epk']);
+        static::assertArrayHasKey('kty', $header['epk']);
+        static::assertArrayHasKey('x', $header['epk']);
+        static::assertArrayNotHasKey('y', $header['epk']);
+        static::assertSame('X25519', $header['epk']['crv']);
+        static::assertSame('OKP', $header['epk']['kty']);
+        static::assertSame($cek, $ecdh_es->unwrapAgreementKey($private, null, $encrypted_cek, 128, $header));
+    }
+
     /**
      * @test
      */
diff --git a/tests/EncryptionAlgorithm/KeyEncryption/ECDHSS/ECDHSSKeyAgreementTest.php b/tests/EncryptionAlgorithm/KeyEncryption/ECDHSS/ECDHSSKeyAgreementTest.php
@@ -52,6 +52,82 @@ public function getAgreementKey(): void
         static::assertArrayNotHasKey('epk', $additional_header_values);
     }
 
+    /**
+     * @test
+     */
+    public function getAgreementKeyWithA128KeyWrapAndOctetKeyPairKey(): void
+    {
+        $additional_header_values = [
+            'enc' => 'A128GCM',
+        ];
+        $sender = new JWK([
+            'kty' => 'OKP',
+            'crv' => 'X25519',
+            'd' => 'uns2Byv3po_cjjG8XRCtU-lEOrOgLbsDr5cXHmgjVvA',
+            'x' => 'k8IkMMO9I0foCYqEcbfM49DjEoWpHdho_GKNMXk1rFw',
+        ]);
+        $receiver = new JWK([
+            'kty' => 'EC',
+            'crv' => 'X25519',
+            'd' => 'tzF6dJQtUYj2G60lzzw70A8BGeE_KDDofUdwwm9qIEU',
+            'x' => 'q9mRLLKfK-_SosZoBFs5LaDxSB9KaqbRaenvzy1_lAA',
+        ]);
+
+        $cek = [
+            4,
+            211,
+            31,
+            197,
+            84,
+            157,
+            252,
+            254,
+            11,
+            100,
+            157,
+            250,
+            63,
+            170,
+            106,
+            206,
+            107,
+            124,
+            212,
+            45,
+            111,
+            107,
+            9,
+            219,
+            200,
+            177,
+            0,
+            240,
+            143,
+            156,
+            44,
+            207,
+        ];
+        foreach ($cek as $key => $value) {
+            $cek[$key] = str_pad(dechex($value), 2, '0', STR_PAD_LEFT);
+        }
+        $cek = hex2bin(implode('', $cek));
+
+        $ecdh_ss = new ECDHSSA128KW();
+        $encrypted_cek = $ecdh_ss->wrapAgreementKey(
+            $receiver->toPublic(),
+            $sender,
+            $cek,
+            128,
+            $additional_header_values,
+            $additional_header_values
+        );
+        static::assertArrayNotHasKey('epk', $additional_header_values);
+        static::assertSame(
+            $cek,
+            $ecdh_ss->unwrapAgreementKey($sender->toPublic(), $receiver, $encrypted_cek, 128, $additional_header_values)
+        );
+    }
+
     /**
      * @test
      */

Original file line number	Diff line number	Diff line change
`@@ -15,7 +15,7 @@`
`15`	`15`	`use Symfony\Component\Console\Input\InputInterface;`
`16`	`16`	`use Symfony\Component\Console\Output\OutputInterface;`
`17`	`17`
`18`		`-#[AsCommand(name: 'keyset:add:key', description: 'Add a key into a key set.',)]`
	`18`	`+#[AsCommand(name: 'keyset:add:key', description: 'Add a key into a key set.')]`
`19`	`19`	`final class AddKeyIntoKeysetCommand extends ObjectOutputCommand`
`20`	`20`	`{`
`21`	`21`	`protected function configure(): void`
Original file line number	Diff line number	Diff line change
`@@ -12,7 +12,7 @@`
`12`	`12`	`use Symfony\Component\Console\Input\InputInterface;`
`13`	`13`	`use Symfony\Component\Console\Output\OutputInterface;`
`14`	`14`
`15`		`-#[AsCommand(name: 'key:generate:ec', description: 'Generate an EC key (JWK format)',)]`
	`15`	`+#[AsCommand(name: 'key:generate:ec', description: 'Generate an EC key (JWK format)')]`
`16`	`16`	`final class EcKeyGeneratorCommand extends GeneratorCommand`
`17`	`17`	`{`
`18`	`18`	`protected function configure(): void`
Original file line number	Diff line number	Diff line change
`@@ -13,7 +13,7 @@`
`13`	`13`	`use Symfony\Component\Console\Input\InputInterface;`
`14`	`14`	`use Symfony\Component\Console\Output\OutputInterface;`
`15`	`15`
`16`		`-#[AsCommand(name: 'keyset:generate:ec', description: 'Generate an EC key set (JWKSet format)',)]`
	`16`	`+#[AsCommand(name: 'keyset:generate:ec', description: 'Generate an EC key set (JWKSet format)')]`
`17`	`17`	`final class EcKeysetGeneratorCommand extends GeneratorCommand`
`18`	`18`	`{`
`19`	`19`	`protected function configure(): void`
Original file line number	Diff line number	Diff line change
`@@ -17,7 +17,7 @@`
`17`	`17`	`use Symfony\Component\Console\Input\InputInterface;`
`18`	`18`	`use Symfony\Component\Console\Output\OutputInterface;`
`19`	`19`
`20`		`-#[AsCommand(name: 'key:analyze', description: 'JWK quality analyzer.',)]`
	`20`	`+#[AsCommand(name: 'key:analyze', description: 'JWK quality analyzer.')]`
`21`	`21`	`final class KeyAnalyzerCommand extends Command`
`22`	`22`	`{`
`23`	`23`	`public function __construct(`
Original file line number	Diff line number	Diff line change
`@@ -11,7 +11,7 @@`
`11`	`11`	`use Symfony\Component\Console\Input\InputInterface;`
`12`	`12`	`use Symfony\Component\Console\Output\OutputInterface;`
`13`	`13`
`14`		`-#[AsCommand(name: 'key:generate:oct', description: 'Generate an octet key (JWK format)',)]`
	`14`	`+#[AsCommand(name: 'key:generate:oct', description: 'Generate an octet key (JWK format)')]`
`15`	`15`	`final class OctKeyGeneratorCommand extends GeneratorCommand`
`16`	`16`	`{`
`17`	`17`	`protected function configure(): void`