includes/password/Argon2Password.php

   1 <?php
   2 /**
   3  * This program is free software; you can redistribute it and/or modify
   4  * it under the terms of the GNU General Public License as published by
   5  * the Free Software Foundation; either version 2 of the License, or
   6  * (at your option) any later version.
   7  *
   8  * This program is distributed in the hope that it will be useful,
   9  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  10  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  11  * GNU General Public License for more details.
  12  *
  13  * You should have received a copy of the GNU General Public License along
  14  * with this program; if not, write to the Free Software Foundation, Inc.,
  15  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
  16  * http://www.gnu.org/copyleft/gpl.html
  17  *
  18  * @file
  19  */
  20
  21 declare( strict_types = 1 );
  22
  23 namespace MediaWiki\Password;
  24
  25 use LogicException;
  26
  27 /**
  28  * Implements Argon2, a modern key derivation algorithm designed to resist GPU cracking and
  29  * side-channel attacks.
  30  *
  31  * @see https://en.wikipedia.org/wiki/Argon2
  32  */
  33 class Argon2Password extends Password {
  34         /**
  35          * @var null[] Array with known password_hash() option names as keys
  36          */
  37         private const KNOWN_OPTIONS = [
  38                 'memory_cost' => null,
  39                 'time_cost' => null,
  40                 'threads' => null,
  41         ];
  42
  43         /**
  44          * @inheritDoc
  45          */
  46         protected function isSupported(): bool {
  47                 return defined( 'PASSWORD_ARGON2ID' );
  48         }
  49
  50         /**
  51          * @return mixed[] Array of 2nd and third parameters to password_hash()
  52          */
  53         private function prepareParams(): array {
  54                 switch ( $this->config['algo'] ) {
  55                         case 'argon2i':
  56                                 $algo = PASSWORD_ARGON2I;
  57                                 break;
  58                         case 'argon2id':
  59                         case 'auto':
  60                                 $algo = PASSWORD_ARGON2ID;
  61                                 break;
  62                         default:
  63                                 throw new LogicException( "Unexpected algo: {$this->config['algo']}" );
  64
  65                 }
  66
  67                 $params = array_intersect_key( $this->config, self::KNOWN_OPTIONS );
  68
  69                 return [ $algo, $params ];
  70         }
  71
  72         /**
  73          * @inheritDoc
  74          */
  75         public function crypt( string $password ): void {
  76                 [ $algo, $params ] = $this->prepareParams();
  77                 $this->hash = password_hash( $password, $algo, $params );
  78         }
  79
  80         /**
  81          * @inheritDoc
  82          */
  83         public function verify( string $password ): bool {
  84                 return password_verify( $password, $this->hash );
  85         }
  86
  87         /**
  88          * @inheritDoc
  89          */
  90         public function toString(): string {
  91                 $res = ":argon2:{$this->hash}";
  92                 $this->assertIsSafeSize( $res );
  93                 return $res;
  94         }
  95
  96         /**
  97          * @inheritDoc
  98          */
  99         public function needsUpdate(): bool {
 100                 [ $algo, $params ] = $this->prepareParams();
 101                 return password_needs_rehash( $this->hash, $algo, $params );
 102         }
 103 }
 104
 105 /** @deprecated since 1.43 use MediaWiki\\Password\\Argon2Password */
 106 class_alias( Argon2Password::class, 'Argon2Password' );