includes/password/Argon2Password.php

   1 <?php
   2 /**
   3  * This program is free software; you can redistribute it and/or modify
   4  * it under the terms of the GNU General Public License as published by
   5  * the Free Software Foundation; either version 2 of the License, or
   6  * (at your option) any later version.
   7  *
   8  * This program is distributed in the hope that it will be useful,
   9  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  10  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  11  * GNU General Public License for more details.
  12  *
  13  * You should have received a copy of the GNU General Public License along
  14  * with this program; if not, write to the Free Software Foundation, Inc.,
  15  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
  16  * http://www.gnu.org/copyleft/gpl.html
  17  *
  18  * @file
  19  */
  20
  21 declare( strict_types = 1 );
  22
  23 /**
  24  * Implements Argon2, a modern key derivation algorithm designed to resist GPU cracking and
  25  * side-channel attacks.
  26  *
  27  * @see https://en.wikipedia.org/wiki/Argon2
  28  */
  29 class Argon2Password extends Password {
  30         /**
  31          * @var null[] Array with known password_hash() option names as keys
  32          */
  33         private const KNOWN_OPTIONS = [
  34                 'memory_cost' => null,
  35                 'time_cost' => null,
  36                 'threads' => null,
  37         ];
  38
  39         /**
  40          * @inheritDoc
  41          */
  42         protected function isSupported() : bool {
  43                 // It is actually possible to have a PHP build with Argon2i but not Argon2id
  44                 return defined( 'PASSWORD_ARGON2I' ) || defined( 'PASSWORD_ARGON2ID' );
  45         }
  46
  47         /**
  48          * @return mixed[] Array of 2nd and third parmeters to password_hash()
  49          */
  50         private function prepareParams() : array {
  51                 switch ( $this->config['algo'] ) {
  52                         case 'argon2i':
  53                                 $algo = PASSWORD_ARGON2I;
  54                                 break;
  55                         case 'argon2id':
  56                                 $algo = PASSWORD_ARGON2ID;
  57                                 break;
  58                         case 'auto':
  59                                 $algo = defined( 'PASSWORD_ARGON2ID' ) ? PASSWORD_ARGON2ID : PASSWORD_ARGON2I;
  60                                 break;
  61                         default:
  62                                 throw new LogicException( "Unexpected algo: {$this->config['algo']}" );
  63
  64                 }
  65
  66                 $params = array_intersect_key( $this->config, self::KNOWN_OPTIONS );
  67
  68                 return [ $algo, $params ];
  69         }
  70
  71         /**
  72          * @inheritDoc
  73          */
  74         public function crypt( string $password ) : void {
  75                 list( $algo, $params ) = $this->prepareParams();
  76                 $this->hash = password_hash( $password, $algo, $params );
  77         }
  78
  79         /**
  80          * @inheritDoc
  81          */
  82         public function verify( string $password ) : bool {
  83                 return password_verify( $password, $this->hash );
  84         }
  85
  86         /**
  87          * @inheritDoc
  88          */
  89         public function toString() : string {
  90                 $res = ":argon2:{$this->hash}";
  91                 $this->assertIsSafeSize( $res );
  92                 return $res;
  93         }
  94
  95         /**
  96          * @inheritDoc
  97          */
  98         public function needsUpdate() : bool {
  99                 list( $algo, $params ) = $this->prepareParams();
 100                 return password_needs_rehash( $this->hash, $algo, $params );
 101         }
 102 }