2019040800_updateTrustedDetailsParms.php

<?php
/**
 * Notes:
 * 1. Anything complicated needs to be done with SQL.
 * 2. Always have a check to know if the migration needs to occur (up or down).
 * 3. Use up() and down(), not change(), because of the SQL
 */
use Phinx\Migration\AbstractMigration;
// Constants for parm related encryption
define("PARMENCDEC_CIPHER_MODE", "aes-256-cbc");
// allowed values: sha1, sha256
define("PARMENCDEC_AUTH_HASH_ALGO", "sha256");

function GetOpenSSLKeyBilbo() {

  return "VXVtbYOrbt5avJme6ihbeS9MznYMPe9a";
}

function GetOpenSSLKeyBugs() {
  return "w0ki5QwpYWkM2FpitNEsosG9HGL9uogS";
}

/**
 * COPY FROM hcuCommon.i
 */
function getOpenSSLKey($key_suffix, $bit_size='256') {
    // output raw binary data for key
    $raw_output = true;

    if ($bit_size != '256')
        throw new exception("Invalid key size. Supported: [256] bits.", 3);

    $hashKeyBilbo = GetOpenSSLKeyBilbo() . $key_suffix;
    $hashKeyBugs = GetOpenSSLKeyBugs() . $key_suffix;

    // TODO: consider sha3-256?
    $defaultKey = hash_hmac('sha256', $hashKeyBilbo, $hashKeyBugs, $raw_output); // Get 256-bit key

    switch($bit_size) {
    case '256':
        return $defaultKey;
        break;

    default:
        return $defaultKey;
    }
}

/**
 * COPY FROM hcuCommon.i
 */
function getEncryptionAuthHash($message, $key_suffix, $auth_hash_algo, $auth_hash_binary) {
    if ($auth_hash_algo != 'sha1' && $auth_hash_algo != 'sha256') {
        throw new exception("Invalid hash algorithm: ". $auth_hash_algo, 2);
    }
    $hashKeyBilbo = GetOpenSSLKeyBilbo() . $key_suffix;
    return hash_hmac($auth_hash_algo, $message, $hashKeyBilbo, $auth_hash_binary);
}


/**
 * COPY FROM hcuCommon.i
 */
function hcuOpenSSLEncrypt($message,
                           $key_suffix,
                           $method='aes-256-cbc',
                           $auth_hash_algo='sha1',
                           $auth_hash_binary=true,
                           $iv="",
                           $context="default") {

    // auth algo validation
    if ($auth_hash_algo != 'sha1' && $auth_hash_algo != 'sha256') {
        throw new exception("Invalid hash algorithm: ". $auth_hash_algo, 2);
    }
    // if initialization vector is not provided, we generate one by default
    // Obviously, IV would need to be returned along with the encrypted
    // ciphercode for various encryption modes, eg. except ECB. use context
    // argument to handle how to return the IV value back to the caller
    // Default context appends the IV to the ciphertext.
    $ivsize = openssl_cipher_iv_length($method);
    if ($iv == "") {
        $iv = openssl_random_pseudo_bytes($ivsize);
    } else {
        $iv = mb_substr($iv, 0, $ivsize, '8bit');
    }

    // Set encryption options before executing w.r.t. $context
    // OPTIONS:
    // OPENSSL_ZERO_PADDING: expects data to be space padded before encryption
    // OPENSSL_RAW_DATA: generate raw binary ciphertext
    if($context == "connect_chkfree" ||
       $context == "connect_ezcard" ||
       $context == "connect_certegy" ||
       $context == "connect_digital" ||
       $context == "connect_ipay" ||
       $context == "connect_vsoft" ||
       $context == "connect_mvi")
    {
        // expects that the data is already padded appropriately
        // otherwise encryption with these options will fail
        $openssl_options = OPENSSL_RAW_DATA|OPENSSL_ZERO_PADDING;
        $encryptionKey = $key_suffix;
    }
    // defaults
    else {
        // PKCS7 padding and RAW ciphertext
        $openssl_options = OPENSSL_RAW_DATA;
        $encryptionKey = getOpenSSLKey($key_suffix);
    }

    // ENCRYPTION
    $ciphertext = openssl_encrypt($message,
                                  $method,
                                  $encryptionKey,
                                  $openssl_options,
                                  $iv);

    // iv and ciphertext are part of the default message
    // Default context appends the IV to the ciphertext in a raw format.
    $defaultCipher = $iv . $ciphertext;
    $defaultHash = getEncryptionAuthHash($defaultCipher,
                                         $key_suffix,
                                         $auth_hash_algo,
                                         $auth_hash_binary);
    $defaultResp = array("message" => $defaultCipher, "hash" => $defaultHash);

    // Prepare response after encryption based on the context of the encryption
    switch($context) {
    case "connect_chkfree":
    case "connect_ezcard":
    case "connect_certegy":
    case "connect_digital":
    case "connect_ipay":
    case "connect_vsoft":
    case "connect_mvi":
        $connectCipher = $ciphertext;
        $returnArray = array("message" => $connectCipher, "iv" => $iv);
        break;

    case "credentials":
        $credentialCipher = $ciphertext;
        $returnArray = array("message" => $credentialCipher, "iv" => $iv);
        break;

    // also for context="default" (case "default":)
    case "default":
    default:
        $returnArray= $defaultResp;
    }
    return $returnArray;
}

/**
 * COPY FROM hcuCommon.i
 */
function hcuOpenSSLDecrypt($message,
                           $hash,
                           $key_suffix,
                           $method='aes-256-cbc',
                           $auth_hash_algo="sha1",
                           $auth_hash_binary=true,
                           $iv="",
                           $context="default")
{
    $hashKeyBilbo = GetOpenSSLKeyBilbo() . $key_suffix;
    $ivsize = openssl_cipher_iv_length($method);
    if ($iv != "") {
        $iv = mb_substr($iv, 0, $ivsize, '8bit');
    }

    // DEFAULTS
    // OPTIONS:
    // OPENSSL_ZERO_PADDING: expects data to be space padded before encryption
    // OPENSSL_RAW_DATA: generate raw binary ciphertext
    $openssl_options = OPENSSL_RAW_DATA;
    $encryptionKey = getOpenSSLKey($key_suffix);
    $ciphertext = $message;

    switch($context) {
    case "connect_chkfree":
    case "connect_ezcard":
    case "connect_certegy":
    case "connect_digital":
    case "connect_ipay":
    case "connect_vsoft":
    case "connect_mvi":
        $openssl_options = OPENSSL_RAW_DATA|OPENSSL_ZERO_PADDING;
        $encryptionKey = $key_suffix;
        break;

    case "credentials":
        if ($iv == "") {
            throw new exception("IV cannot be empty for Credentials.", 3);
        }
        break;

    case "default":
    default:
        // $expectedHash = hash_hmac($auth_hash_algo, $message, $hashKeyBilbo, $auth_hash_binary);
        $expectedHash = getEncryptionAuthHash($message,
                                         $key_suffix,
                                         $auth_hash_algo,
                                         $auth_hash_binary);
        if (md5($expectedHash) !== md5($hash))
            throw new exception("Hash doesn't match!", 2);

        // iv and ciphertext are the part of the default $message
        $iv = mb_substr($message, 0, $ivsize, '8bit');
        $ciphertext = mb_substr($message, $ivsize, null, '8bit');
    }

    // DECRYPTION
    return openssl_decrypt($ciphertext,
                           $method,
                           $encryptionKey,
                           $openssl_options,
                           $iv);
}
/**
 * COPY FROM cutrusted.i
 */
function addpadding($string, $blocksize = 32) {
    # implements PKCS7 padding
    $len = strlen($string);
    $pad = $blocksize - ($len % $blocksize);
    $string .= str_repeat(chr($pad), $pad);
    return $string;
}

/**
 * COPY FROM cutrusted.i
 */
function strippadding($string) {
    $slast = ord(substr($string, -1));
    $slastc = chr($slast);

    $match= "/\\x" . dechex($slast) . "{" . $slast . "}/"; 

    if (strlen($string) && preg_match($match, $string)) {
        $string = substr($string, 0, strlen($string) - $slast);
        return $string;
    } else {
        return false;
    }
}

/**
 * COPIED/MODIFIED from cutrusted.i
 */
function parmencrypt($str,
                     $key,
                     $cipher_method=PARMENCDEC_CIPHER_MODE) {
    try {
        $enc_resp = hcuOpenSSLEncrypt($str,
                                     $key,
                                     $method=$cipher_method,
                                     $auth_hash_algo=PARMENCDEC_AUTH_HASH_ALGO);

        $ciphertext = $enc_resp["message"];
        $hash_hmac = $enc_resp["hash"];
        return base64_encode($hash_hmac.$ciphertext);
    } catch (Exception $ex) {
        throw $ex;
    }

}

/**
 * COPIED/MODIFIED from cutrusted.i
 */
function parmencrypt_mcrypt($str, $key) {
    $key_size = mcrypt_get_key_size(MCRYPT_RIJNDAEL_256, MCRYPT_MODE_ECB);
    $key = substr($key, 0, $key_size);
    $iv_size = mcrypt_get_iv_size(MCRYPT_RIJNDAEL_256, MCRYPT_MODE_ECB);
    $blocksize = mcrypt_get_block_size(MCRYPT_RIJNDAEL_256, MCRYPT_MODE_ECB);
    $iv = mcrypt_create_iv($iv_size, MCRYPT_RAND);
    $str = addpadding($str, $blocksize);
    return base64_encode(mcrypt_encrypt(MCRYPT_RIJNDAEL_256, $key, $str, MCRYPT_MODE_ECB, $iv));
}

/**
 * COPIED/MODIFIED from cutrusted.i
 */
function parmdecrypt_openssl($str,
                             $key,
                             $cipher_method) {
    try {
        $cipher_all = base64_decode($str);

        if(PARMENCDEC_AUTH_HASH_ALGO == "sha256") {
            $auth_hash_len = 32; // bytes
        }
        // PARMENCDEC_AUTH_HASH_ALGO == "sha1"
        else {
            $auth_hash_len = 16; //bytes
        }

        $encrypted_hash = substr($cipher_all, 0, $auth_hash_len);
        $ciphertext = substr($cipher_all, $auth_hash_len);

        return hcuOpenSSLDecrypt($ciphertext,
                                 $encrypted_hash,
                                 $key,
                                 $method=$cipher_method,
                                 $auth_hash_algo=PARMENCDEC_AUTH_HASH_ALGO);
    } catch (Exception $ex) {
        return False;
    }
}


/**
 * COPIED/MODIFIED from cutrusted.i
 */
function parmdecrypt_mcrypt($orig_str, $orig_key) {
    try{
        $base64_str = base64_decode($orig_str);
        $key_size = mcrypt_get_key_size(MCRYPT_RIJNDAEL_256, MCRYPT_MODE_ECB);
        $key = substr($orig_key, 0, $key_size);
        $iv_size = mcrypt_get_iv_size(MCRYPT_RIJNDAEL_256, MCRYPT_MODE_ECB);
        $iv = mcrypt_create_iv($iv_size, MCRYPT_RAND);
        $str = mcrypt_decrypt(MCRYPT_RIJNDAEL_256, $key, $base64_str, MCRYPT_MODE_ECB, $iv);
        return strippadding($str);
    } catch (exception $ex) {
        return false;
    }

}

/**
 * COPIED/MODIFIED from cutrusted.i
 */
function parmdecrypt($orig_str,
                     $orig_key,
                     $cipher_method=PARMENCDEC_CIPHER_MODE) {
    try {
        $openssl_decrypt_result = parmdecrypt_openssl($orig_str,
                                                      $orig_key,
                                                      $cipher_method=$cipher_method);
        // NOTE: code block in if section will be deleted along with
        // parmdecrypt_mcrypt function and parmdecrypt_openssl will be
        // merged here

        // unable to decrypt with openssl_decrypt
        if($openssl_decrypt_result == False) {
            $mcrypt_decrypt_result = parmdecrypt_mcrypt($orig_str, $orig_key);
            if ($mcrypt_decrypt_result == false) {
                // Error, could not be decrypted with either api: mcrypt or openssl
                throw new exception("Error: Parm could not be decrypted.");
            }
            else {
                // successfully decrypted using mcrypt
                return $mcrypt_decrypt_result;
            }
        } else {
            // successfully decrypted using openssl
            return $openssl_decrypt_result;
        }
    } catch(Exception $ex){
        throw $ex;
    }
}

function mcrypt_lib_exists() {
    // since cumanage is still based on the base image, we would know
    // if the latest php version includes the mcrypt based functions
    // or not
    if(function_exists('mcrypt_encrypt')) {
        return True;
    } else {
        return False;  
    }
}

class UpdateTrustedDetailsParms extends AbstractMigration {

    public function up() {
        if (mcrypt_lib_exists()) {

            $tableName = "cutrusteddetail";
            $exists = $this->hasTable($tableName);

            if ($exists) {
                $sql = "select cu, trustedid, parms from ${tableName}";
                $trustedDetailsList = $this->fetchAll($sql);
                
                for ($i=0; $i< count($trustedDetailsList); $i++) {
              
                    $Cu = strtoupper(trim($trustedDetailsList[$i]["cu"]));
                    $trustedid = trim($trustedDetailsList[$i]["trustedid"]);
                    $tddkey = sha1("${Cu}:3pk4osso");                    

                    $parms_old_encrypt = trim($trustedDetailsList[$i]["parms"]);
                    if (!is_null($parms_old_encrypt) && $parms_old_encrypt != '') {
                        // decrypt the ciphertext regardless of the library
                        $decrypt_content = parmdecrypt($parms_old_encrypt, $tddkey);

                        // encrypt with openssl
                        $enc_content = parmencrypt($decrypt_content, $tddkey);
                        $sql = "update ${tableName} set parms='${enc_content}' where cu='${Cu}' and trustedid='${trustedid}'";
                        $this->query($sql);
                        
                    }
                }
            }        
        }
    }

    /* To execute this you need to run the following command:
     * php vendor/bin/phinx rollback (using correct path to phinx)
     */

    public function down() {
        if (mcrypt_lib_exists()) {

            $tableName = "cutrusteddetail";
            $exists = $this->hasTable($tableName);

            if ($exists) {
                $sql = "select cu, trustedid, parms from ${tableName}";
                $trustedDetailsList = $this->fetchAll($sql);
                for ($i=0; $i< count($trustedDetailsList); $i++) {
              
                    $Cu = strtoupper(trim($trustedDetailsList[$i]["cu"]));
                    $trustedid = trim($trustedDetailsList[$i]["trustedid"]);
                    $tddkey = sha1("${Cu}:3pk4osso");

                    $parms_old_encrypt = trim($trustedDetailsList[$i]["parms"]);

                    if (!is_null($parms_old_encrypt) && $parms_old_encrypt != '') {
                        // decrypt the ciphertext regardless of the library                        
                        $decrypt_content = parmdecrypt($parms_old_encrypt, $tddkey);

                        // encrypt back with mcrypt
                        $enc_content = parmencrypt_mcrypt($decrypt_content, $tddkey);
                        $sql = "update ${tableName} set parms='${enc_content}' where cu='${Cu}' and trustedid='${trustedid}'";
                        $this->query($sql);
                    }
                }
            }
        }
    }

}

?>