Odyssey
SSOEncryption.i
1 <?php
2 
3 /**
4  * This script includes the Encryption related functions that HomeCU Banking
5  * uses to send secured and encrypted requests to the third party vendors/SSOs
6  * endpoints.
7  *
8  * Majority of encryption functions are called from hcuConnect.prg.
9  * Interfaces include:
10  * - CHCKFREE
11  * - EasyCard
12  * - DIGITAL
13  * - Certegy
14  * - IPAY/Billpay
15  * - VSHO/VSOFT
16  *
17  * Other interface: (hcuImages.i)
18  * - MVI
19  *
20  * Major goal is to migrate from MCRYPT based encryption API to
21  * OPENSSL based encryption API in PHP. MCRYPT will be deprecated in PHP7.2+.
22  *
23  * For each interface, there is implementation for both encryption and
24  * decryption using both MCRYPT and OPENSSL API. MCRYPT based API
25  * checks for the related function existence and they can be removed
26  * after confirming the openssl based functions' correctness.
27  * The accuracy of generation of same ciphertext using
28  * both the libraries, third party specification conformity
29  * and inter-library compatibility have been tested with various
30  * unit tests in test/unit/lib/bankingHcuConnect.php script.
31  *
32  * It's encouraged add and delete encryption related functions relevant to
33  * third party interfaces in this script and add unit tests to thoroughly
34  * test the edge cases.
35  *
36  */
37 
38 // OPENSSL based encryption mode constants
39 define("TICKET_CIPHERMODE", 'des-ede3-cbc'); // equivalent to MCRYPT_TRIPLEDES + MCRYPT_MODE_CBC
40 define("EZCARD_CIPHERMODE", 'des-ede3-cbc'); // equivalent to MCRYPT_TRIPLEDES + MCRYPT_MODE_CBC
41 define("CERTEGY_CIPHERMODE", 'des-ede3'); // equivalent to MCRYPT_TRIPLEDES + MCRYPT_MODE_ECB
42 define("DIGITAL_CIPHERMODE", 'des-ede3'); // equivalent to MCRYPT_TRIPLEDES + MCRYPT_MODE_ECB
43 define("BILLPAY_CIPHERMODE", 'cast5-ecb'); // equivalent to MCRYPT_CAST_128 + MCRYPT_MODE_ECB
44 define("VSOFT_CIPHERMODE", 'aes-256-ecb'); // equivalent to MCRYPT_RIJNDAEL_128 + MCRYPT_MODE_ECB
45 
46 define("MVI_CIPHERMODE", 'aes-256-cbc'); // equivalent to MCRYPT_RIJNDAEL_128 + MCRYPT_MODE_CBC
47 define("SAVVYMO_CIPHERMODE", 'aes-256-cbc'); // equivalent to MCRYPT_RIJNDAEL_128 + MCRYPT_MODE_CBC
48 
49 // hash algorithm to be used (if added anywhere) for authentication
50 define("THIRDPARTY_DEFAULT_AUTH_ALGO", "sha256");
51 
52 
53 /**
54  * check if mcrypt library exists
55  */
56 function check_mcrypt_exists() {
57  if (!function_exists("mdecrypt_generic") && !function_exists("mcrypt_generic"))
58  throw new exception("MCRYPT library does not exist.");
59 }
60 
61 //****************************
62 //****** CHKFREE
63 //***************************
64 /**
65  * USED ONLY FOR TESTING
66  * TO BE DEPRECATED
67  */
68 function encrypt_ticket_mcrypt($ticket, $key, $iv) {
69  check_mcrypt_exists();
70  # pad so length of ticket is even multiple of 8
71  $ticket .= str_repeat(' ', 8 - (strlen($ticket) % 8));
72  $td = mcrypt_module_open(MCRYPT_3DES, '', MCRYPT_MODE_CBC, '');
73  mcrypt_generic_init($td, $key, $iv);
74  $tktvalue = mcrypt_generic($td, $ticket);
75  $tktvalue = bin2hex($tktvalue);
76  mcrypt_generic_deinit($td);
77  mcrypt_module_close($td);
78  return array($tktvalue, $ticket);
79 }
80 
81 /**
82  * Encrypt CHKFREE using openssl
83  */
84 function encrypt_ticket_openssl($ticket, $key, $iv) {
85  try {
86  # pad so length of ticket is even multiple of 8
87  $ticket .= str_repeat(' ', 8 - (strlen($ticket) % 8));
88  $openssl_enc = hcuOpenSSLEncrypt($ticket,
89  $key,
90  TICKET_CIPHERMODE,
91  THIRDPARTY_DEFAULT_AUTH_ALGO,
92  true,
93  $iv=$iv,
94  $context="connect_chkfree");
95  return array(bin2hex($openssl_enc["message"]), $ticket);
96  } catch (exception $ex) {
97  throw $ex;
98  }
99 }
100 
101 /**
102  * USED ONLY FOR TESTING
103  * TO BE DEPRECATED
104  */
105 function decrypt_ticket_mcrypt($ticket, $key, $iv) {
106  check_mcrypt_exists();
107  try {
108  if(function_exists("mdecrypt_generic")) {
109  $ticket = hex2bin($ticket);
110  $td = mcrypt_module_open(MCRYPT_3DES, '', MCRYPT_MODE_CBC, '');
111  mcrypt_generic_init($td, $key, $iv);
112  $tktvalue = mdecrypt_generic($td, $ticket);
113  mcrypt_generic_deinit($td);
114  mcrypt_module_close($td);
115 
116  return $tktvalue;
117  }
118  } catch (exception $ex) {
119  throw $ex;
120  }
121 }
122 
123 /**
124  * Used only for testing openssl based CHKFREE encryption
125  */
126 function decrypt_ticket_openssl($ticket, $key, $iv) {
127  try {
128  $ticket = hex2bin($ticket);
129  $dec_ticket = hcuOpenSSLDecrypt($ticket,
130  "",
131  $key,
132  TICKET_CIPHERMODE,
133  THIRDPARTY_DEFAULT_AUTH_ALGO,
134  true,
135  $iv=$iv,
136  $context="connect_chkfree");
137  return $dec_ticket;
138 
139 
140  } catch (exception $ex) {
141  throw $ex;
142  }
143 }
144 
145 //****************************
146 //****** EasyCard
147 //***************************
148 
149 /**
150  * Encrypt EZCARD using openssl
151  */
152 function encrypt_ezcard_openssl($ssoPkt, $key, $iv) {
153  try {
154  // maintaining string padding
155  //space pad data to make an even 8-byte boundary
156  $blocksize = 8;
157  $pad = $blocksize - (strlen($ssoPkt) % $blocksize);
158  $ssoPkt = ($ssoPkt . str_repeat(chr($pad), $pad));
159  // uses no padding in encryption for ezcard context
160  $openssl_enc = hcuOpenSSLEncrypt($ssoPkt,
161  $key,
162  EZCARD_CIPHERMODE,
163  THIRDPARTY_DEFAULT_AUTH_ALGO,
164  true,
165  $iv=$iv,
166  $context="connect_ezcard");
167  $packet = base64_encode($openssl_enc["message"]);
168  $packet = str_replace(array("+", "/", "="), array("-", "_", "."), $packet);
169  return array($packet, $ssoPkt);
170 
171  } catch (exception $ex) {
172  throw $ex;
173  }
174 }
175 
176 /**
177  * USED ONLY FOR TESTING
178  * TO BE DEPRECATED
179  */
180 function encrypt_ezcard_mcrypt($td_cbc, $ssoPkt, $key, $iv) {
181  check_mcrypt_exists();
182 
183  // space/null byte padding - even to 8 bytes
184  $blocksize = mcrypt_enc_get_block_size($td_cbc);
185  $pad = $blocksize - (strlen($ssoPkt) % $blocksize);
186  $ssoPkt = ($ssoPkt . str_repeat(chr($pad), $pad));
187 
188  mcrypt_generic_init($td_cbc, $key, $iv);
189  $packet = mcrypt_generic($td_cbc, $ssoPkt);
190  mcrypt_generic_deinit($td_cbc);
191 
192  $packet = base64_encode($packet);
193  $packet = str_replace(array("+", "/", "="), array("-", "_", "."), $packet);
194  // also returns padded string
195  return array($packet, $ssoPkt);
196 }
197 
198 /**
199  * Used only for testing EZCARD encryption using openssl
200  */
201 function decrypt_ezcard_openssl($ssoPktEnc, $key, $iv) {
202  try {
203  $ssoPktEnc = str_replace(array("-", "_", "."), array("+", "/", "="), $ssoPktEnc);
204  $ssoPktEnc = base64_decode($ssoPktEnc);
205  $ssoPktDec = hcuOpenSSLDecrypt($ssoPktEnc,
206  "",
207  $key,
208  EZCARD_CIPHERMODE,
209  THIRDPARTY_DEFAULT_AUTH_ALGO,
210  true,
211  $iv=$iv,
212  $context="connect_ezcard");
213  return $ssoPktDec;
214 
215  } catch (exception $ex) {
216  throw $ex;
217  }
218 }
219 
220 /**
221  * USED ONLY FOR TESTING
222  * TO BE DEPRECATED
223  */
224 function decrypt_ezcard_mcrypt($ssoPktEnc, $key, $priviv) {
225  check_mcrypt_exists();
226  // get ready for encryption
227  $td_cbc = mcrypt_module_open(MCRYPT_3DES, '', MCRYPT_MODE_CBC, '');
228  $iv = substr($priviv, 0, mcrypt_enc_get_iv_size($td_cbc));
229 
230  $ssoPktEnc = str_replace(array("-", "_", "."), array("+", "/", "="), $ssoPktEnc);
231  $ssoPktEnc = base64_decode($ssoPktEnc);
232 
233  mcrypt_generic_init($td_cbc, $key, $iv);
234  $ssoPktDec = mdecrypt_generic($td_cbc, $ssoPktEnc);
235  mcrypt_generic_deinit($td_cbc);
236 
237  // close mcrypt module
238  mcrypt_module_close($td_cbc);
239 
240  return $ssoPktDec;
241 }
242 
243 /**
244  * Used to encrypt inner and outer easycard packet using OPENSSL
245  */
246 // openssl ezcard main
247 function encrypt_ezcard_sso($ssoRequest,
248  $clientId,
249  $privkey,
250  $pubkey,
251  $iv,
252  $salt) {
253  // build the inner packet, pad, encrypt, base64 encode
254  list($innerpkt, $paddedSsoRequest) = encrypt_ezcard_openssl($ssoRequest, $privkey, $iv);
255  // use inner packet to build outer packet, pad, encrypt, base64 encode
256 
257  $ssoWrap = "$salt<SSOWrapper ClientId=\"{$clientId}\" SSORequest=\"$innerpkt\" Ver=\"3.0\"/>";
258  list($outpkt, $paddedSsoWrap) = encrypt_ezcard_openssl($ssoWrap, $pubkey, $iv);
259 
260  $outpkt = str_replace(array("+", "/", "="), array("-", "_", "."), $outpkt);
261  return array($paddedSsoRequest, $innerpkt, $paddedSsoWrap, $outpkt);
262 }
263 
264 /**
265  * USED ONLY FOR TESTING
266  * TO BE DEPRECATED
267  */
268 // mcrypt ezcard main
269 function encrypt_ezcard_sso_mcrypt($ssoRequest,
270  $clientId,
271  $privkey,
272  $pubkey,
273  $priviv,
274  $salt) {
275  check_mcrypt_exists();
276  // get ready for encryption
277  $td = mcrypt_module_open(MCRYPT_3DES, '', MCRYPT_MODE_CBC, '');
278  $iv = substr($priviv, 0, mcrypt_enc_get_iv_size($td));
279 
280  // build the inner packet, pad, encrypt, base64 encode
281  list($innerpkt, $paddedSsoRequest) = encrypt_ezcard_mcrypt($td, $ssoRequest, $privkey, $iv);
282 
283  // use inner packet to build outer packet, pad, encrypt, base64 encode
284  $ssoWrap = "$salt<SSOWrapper ClientId=\"{$clientId}\" SSORequest=\"$innerpkt\" Ver=\"3.0\"/>";
285  list($outpkt, $paddedSsoWrap) = encrypt_ezcard_mcrypt($td, $ssoWrap, $pubkey, $iv);
286  // modify
287  $outpkt = str_replace(array("+", "/", "="), array("-", "_", "."), $outpkt);
288 
289  // close mcrypt module
290  mcrypt_module_close($td);
291  // also return padded strings
292  return array($paddedSsoRequest, $innerpkt, $paddedSsoWrap, $outpkt);
293 }
294 
295 //****************************
296 //****** Certegy
297 //***************************
298 /**
299  * USED ONLY FOR TESTING
300  * TO BE DEPRECATED
301  */
302 function encrypt_certegy_account_mcrypt($ACCOUNT, $key) {
303  #
304  # set values for testing
305  #
306  # $showurl=1;
307  # $FIID="8000"; #CU Institution ID for testing
308  # $ACCOUNT="214027153"; # not enrolled
309  # $ACCOUNT="210328770"; # enrolled";
310  # Implement PKCS5 / PKCS7 Padding (PKCS7 apparently extends PKCS5, but they
311  # are the same for 8-byte blocks)
312  # cipher algorithm needs 8-byte blocks, pad data with binary bytes
313  # - 01 if you need 1 byte, 02 02 if you need 2 bytes, ...
314  # 07 07 07 07 07 07 07 if you need 7 bytes, and if you have a multiple of 8,
315  # pad with 8 bytes 08.
316 
317  check_mcrypt_exists();
318  $blocksize = mcrypt_get_block_size('tripledes', 'ecb');
319  $pad = $blocksize - (strlen($ACCOUNT) % $blocksize);
320  $ACCOUNT = ($ACCOUNT . str_repeat(chr($pad), $pad));
321 
322  $td = mcrypt_module_open(MCRYPT_TRIPLEDES, '', 'ecb', '');
323  $iv = mcrypt_create_iv(mcrypt_enc_get_iv_size($td), MCRYPT_RAND);
324  mcrypt_generic_init($td, $key, $iv);
325  $dm_token = mcrypt_generic($td, $ACCOUNT);
326  mcrypt_generic_deinit($td);
327  mcrypt_module_close($td);
328  // also return padded string
329  return array($dm_token, $ACCOUNT);
330 }
331 
332 /**
333  * USED ONLY FOR TESTING
334  * TO BE DEPRECATED
335  */
336 function decrypt_certegy_account_mcrypt($ACCOUNT_CIPHER, $key) {
337  check_mcrypt_exists();
338  $td = mcrypt_module_open(MCRYPT_TRIPLEDES, '', 'ecb', '');
339  $iv = mcrypt_create_iv(mcrypt_enc_get_iv_size($td), MCRYPT_RAND);
340  mcrypt_generic_init($td, $key, $iv);
341  $ACCOUNT_DECRYPTED = mdecrypt_generic($td, $ACCOUNT_CIPHER);
342  mcrypt_generic_deinit($td);
343  mcrypt_module_close($td);
344  return $ACCOUNT_DECRYPTED;
345 }
346 
347 /**
348  * Encrypt CERTEGY using OPENSSL
349  */
350 function encrypt_certegy_openssl($account, $key) {
351  try {
352  //pad data to make an even 8-byte boundary
353  $blocksize = 8;
354  $pad = $blocksize - (strlen($account) % $blocksize);
355  $account = ($account . str_repeat(chr($pad), $pad));
356 
357  // uses no padding in encryption for ezcard context
358  $openssl_enc = hcuOpenSSLEncrypt($account,
359  $key,
360  CERTEGY_CIPHERMODE,
361  THIRDPARTY_DEFAULT_AUTH_ALGO,
362  true,
363  $iv="",
364  $context="connect_certegy");
365  $account_enc = $openssl_enc["message"];
366  // also return padded string
367  return array($account_enc, $account);
368 
369  } catch (exception $ex) {
370  throw $ex;
371  }
372 }
373 
374 /**
375  * Used only for testing certegy encryption using openssl
376  */
377 function decrypt_certegy_openssl($account_cipher, $key) {
378  try {
379  $account_dec = hcuOpenSSLDecrypt($account_cipher,
380  "",
381  $key,
382  CERTEGY_CIPHERMODE,
383  THIRDPARTY_DEFAULT_AUTH_ALGO,
384  true,
385  $iv="",
386  $context="connect_certegy");
387  return $account_dec;
388 
389  } catch (exception $ex) {
390  throw $ex;
391  }
392 }
393 
394 
395 //****************************
396 //****** Digital
397 //***************************
398 /**
399  * USED ONLY FOR TESTING
400  * TO BE DEPRECATED
401  */
402 function encrypt_digital_mcrypt($srcstring, $servicekey) {
403  # Implement PKCS5 / PKCS7 Padding (PKCS7 apparently extends PKCS5, but they
404  # are the same for 8-byte blocks)
405  # cipher algorithm needs 8-byte blocks, pad data with binary bytes
406  # - 01 if you need 1 byte, 02 02 if you need 2 bytes, ...
407  # 07 07 07 07 07 07 07 if you need 7 bytes, and if you have a multiple of 8,
408  # pad with 8 bytes 08.
409 
410  # values for testing
411  // $CustID="103"; #static string assigned by DigitalMailer
412  // $ACCOUNT="88888888";
413  // $servicepass="thisisatest";
414  // $servicekey="52g2jajrt56syh5j2yf82ngf";
415  // $showurl=1; # look before we leap
416  // $srcstring = "ACCOUNT=88888888&TIMESTAMP=201208011000&CID=103&PASS=thisisatest&GMT=1";
417 
418  check_mcrypt_exists();
419  $blocksize = mcrypt_get_block_size('tripledes', 'ecb');
420  $pad = $blocksize - (strlen($srcstring) % $blocksize);
421  $srcstring = ($srcstring . str_repeat(chr($pad), $pad));
422 
423  $td = mcrypt_module_open(MCRYPT_TRIPLEDES, '', 'ecb', '');
424  $iv = mcrypt_create_iv(mcrypt_enc_get_iv_size($td), MCRYPT_RAND);
425  mcrypt_generic_init($td, $servicekey, $iv);
426  $dm_token = mcrypt_generic($td, $srcstring);
427  mcrypt_generic_deinit($td);
428  mcrypt_module_close($td);
429  // also return padded string
430  return array($dm_token, $srcstring);
431 }
432 
433 /**
434  * USED ONLY FOR TESTING
435  * TO BE DEPRECATED
436  */
437 function decrypt_digital_mcrypt($srcstring_cipher, $servicekey) {
438 
439  check_mcrypt_exists();
440  $td = mcrypt_module_open(MCRYPT_TRIPLEDES, '', 'ecb', '');
441  $iv = mcrypt_create_iv(mcrypt_enc_get_iv_size($td), MCRYPT_RAND);
442  mcrypt_generic_init($td, $servicekey, $iv);
443  $dec_srcstring = mdecrypt_generic($td, $srcstring_cipher);
444  mcrypt_generic_deinit($td);
445  mcrypt_module_close($td);
446  return $dec_srcstring;
447 }
448 
449 /**
450  * Encrypt DIGITAL using OPENSSL
451  */
452 function encrypt_digital_openssl($srcstring, $key) {
453  try {
454  //pad data to make an even 8-byte boundary
455  $blocksize = 8;
456  $pad = $blocksize - (strlen($srcstring) % $blocksize);
457  $srcstring = ($srcstring . str_repeat(chr($pad), $pad));
458 
459  // uses no padding in encryption for ezcard context
460  $openssl_enc = hcuOpenSSLEncrypt($srcstring,
461  $key,
462  DIGITAL_CIPHERMODE,
463  THIRDPARTY_DEFAULT_AUTH_ALGO,
464  true,
465  $iv="",
466  $context="connect_digital");
467  $srcstring_enc = $openssl_enc["message"];
468  // also return padded string
469  return array($srcstring_enc, $srcstring);
470 
471  } catch (exception $ex) {
472  throw $ex;
473  }
474 }
475 
476 /**
477  * Used only for testing digital sourcestring using openssl
478  */
479 function decrypt_digital_openssl($srcstring_cipher, $key) {
480  try {
481  $srcstring_dec = hcuOpenSSLDecrypt($srcstring_cipher,
482  "",
483  $key,
484  DIGITAL_CIPHERMODE,
485  THIRDPARTY_DEFAULT_AUTH_ALGO,
486  true,
487  $iv="",
488  $context="connect_digital");
489  return $srcstring_dec;
490 
491  } catch (exception $ex) {
492  throw $ex;
493  }
494 }
495 
496 //****************************
497 //****** Bill Pay
498 //***************************
499 /**
500  * USED ONLY FOR TESTING
501  * TO BE DEPRECATED
502  */
503 function encrypt_billpay_mcrypt($billpayid, $key) {
504  check_mcrypt_exists();
505  # if billpayid is less than 2 chars, left pad w/zero
506  if (strlen($billpayid) < 2) {
507  $billpayid = substr("00$billpayid", -2, 2);
508  }
509  // null byte padding
510  $billpayid .= str_repeat("\0", 8 - (strlen($billpayid) % 8));
511 
512  $td = mcrypt_module_open(MCRYPT_CAST_128, '', 'ecb', '');
513  $iv = mcrypt_create_iv(mcrypt_enc_get_iv_size($td), MCRYPT_RAND);
514  mcrypt_generic_init($td, $key, $iv);
515  $ipay_token = urlencode(base64_encode(mcrypt_generic($td, $billpayid)));
516  mcrypt_generic_deinit($td);
517  mcrypt_module_close($td);
518  return array($ipay_token, $billpayid);
519 }
520 
521 /**
522  * USED ONLY FOR TESTING
523  * TO BE DEPRECATED
524  */
525 function decrypt_billpay_mcrypt($billpayid_cipher, $key) {
526  check_mcrypt_exists();
527  $td = mcrypt_module_open(MCRYPT_CAST_128, '', 'ecb', '');
528  $iv = mcrypt_create_iv(mcrypt_enc_get_iv_size($td), MCRYPT_RAND);
529  mcrypt_generic_init($td, $key, $iv);
530  $billpayid_cipher = base64_decode(urldecode($billpayid_cipher));
531  $ipay_token_dec = mdecrypt_generic($td, $billpayid_cipher);
532  mcrypt_generic_deinit($td);
533  mcrypt_module_close($td);
534  return $ipay_token_dec;
535 }
536 
537 /**
538  * Encrypt IPAY: Billpay using OPENSSL
539  */
540 function encrypt_billpay_openssl($billpayid, $key) {
541  try {
542  # if billpayid is less than 2 chars, left pad w/zero
543  if (strlen($billpayid) < 2) {
544  $billpayid = substr("00$billpayid", -2, 2);
545  }
546  // null byte padding
547  $billpayid .= str_repeat("\0", 8 - (strlen($billpayid) % 8));
548 
549  $openssl_enc = hcuOpenSSLEncrypt($billpayid,
550  $key,
551  BILLPAY_CIPHERMODE,
552  THIRDPARTY_DEFAULT_AUTH_ALGO,
553  true,
554  $iv="",
555  $context="connect_ipay");
556  $billpayid_enc = urlencode(base64_encode($openssl_enc["message"]));
557  // also return padded string
558  return array($billpayid_enc, $billpayid);
559 
560  } catch (exception $ex) {
561  throw $ex;
562  }
563 }
564 
565 /**
566  * Used only for testing billpayid encryption using openssl
567  */
568 function decrypt_billpay_openssl($billpayid_cipher, $key) {
569  try {
570  $billpayid_cipher = base64_decode(urldecode($billpayid_cipher));
571  $billpayid_dec = hcuOpenSSLDecrypt($billpayid_cipher,
572  "",
573  $key,
574  BILLPAY_CIPHERMODE,
575  THIRDPARTY_DEFAULT_AUTH_ALGO,
576  true,
577  $iv="",
578  $context="connect_ipay");
579  return $billpayid_dec;
580 
581  } catch (exception $ex) {
582  throw $ex;
583  }
584 }
585 
586 //****************************
587 //****** VSOFT/VSHO
588 //***************************
589 /**
590  * USED ONLY FOR TESTING
591  * TO BE DEPRECATED
592  */
593 function encrypt_vsoftquery_mcrypt($vsoftqry, $vsoftkey) {
594  check_mcrypt_exists();
595  # blocksize is 16 bytes
596  $blocksize = mcrypt_get_block_size(MCRYPT_RIJNDAEL_128, 'ecb');
597  $pad = $blocksize - (strlen($vsoftqry) % $blocksize);
598  $vsoftqry = ($vsoftqry . str_repeat(chr($pad), $pad));
599 
600  $td = mcrypt_module_open(MCRYPT_RIJNDAEL_128, '', 'ecb', '');
601  $iv = mcrypt_create_iv(mcrypt_enc_get_iv_size($td), MCRYPT_RAND);
602  mcrypt_generic_init($td, $vsoftkey, $iv);
603  $vsoftenc = mcrypt_generic($td, $vsoftqry);
604  mcrypt_generic_deinit($td);
605  mcrypt_module_close($td);
606 
607  $vsoftenc = base64_encode($vsoftenc);
608  return array($vsoftenc, $vsoftqry);
609 }
610 
611 /**
612  * USED ONLY FOR TESTING
613  * TO BE DEPRECATED
614  */
615 function decrypt_vsoftquery_mcrypt($vsoftqry_cipher, $vsoftkey) {
616  check_mcrypt_exists();
617  $vsoftqry_cipher = base64_decode($vsoftqry_cipher);
618 
619  $td = mcrypt_module_open(MCRYPT_RIJNDAEL_128, '', 'ecb', '');
620  $iv = mcrypt_create_iv(mcrypt_enc_get_iv_size($td), MCRYPT_RAND);
621  mcrypt_generic_init($td, $vsoftkey, $iv);
622  $vsoftdec = mdecrypt_generic($td, $vsoftqry_cipher);
623  mcrypt_generic_deinit($td);
624  mcrypt_module_close($td);
625 
626  return $vsoftdec;
627 }
628 
629 /**
630  * Encrypt VSOFT using openssl
631  */
632 function encrypt_vsoftquery_openssl($vsoftqry, $key) {
633  try {
634  // padding -- blocksize of MCRYPT_RIJNDAEL_128 is/was 16
635  $blocksize = 16;
636  $pad = $blocksize - (strlen($vsoftqry) % $blocksize);
637  $vsoftqry = ($vsoftqry . str_repeat(chr($pad), $pad));
638 
639  $openssl_enc = hcuOpenSSLEncrypt($vsoftqry,
640  $key,
641  VSOFT_CIPHERMODE,
642  THIRDPARTY_DEFAULT_AUTH_ALGO,
643  true,
644  $iv="",
645  $context="connect_vsoft");
646  $vsoftqry_enc = base64_encode($openssl_enc["message"]);
647  // also return padded string
648  return array($vsoftqry_enc, $vsoftqry);
649 
650  } catch (exception $ex) {
651  throw $ex;
652  }
653 }
654 
655 /**
656  * Used only for testing vsoft/vsho encryption for openssl
657  */
658 function decrypt_vsoftquery_openssl($vsoftqry_cipher, $key) {
659  try {
660  $vsoftqry_cipher = base64_decode($vsoftqry_cipher);
661  $vsoftqry_dec = hcuOpenSSLDecrypt($vsoftqry_cipher,
662  "",
663  $key,
664  VSOFT_CIPHERMODE,
665  THIRDPARTY_DEFAULT_AUTH_ALGO,
666  true,
667  $iv="",
668  $context="connect_vsoft");
669  return $vsoftqry_dec;
670 
671  } catch (exception $ex) {
672  throw $ex;
673  }
674 }
675 
676 //****************************
677 //****** MVI
678 //***************************
679 /**
680  * USED ONLY FOR TESTING
681  * TO BE DEPRECATED
682  */
683 function encrypt_mvi_mcrypt($mvi_query, $ckhexkey, $iv="") {
684  # MCRYPT_RIJNDAEL_256 is not AES. The 256 in that constant refers to the blocksize, not the keysize.
685  # Use MCRYPT_RIJNDAEL_128 to get the same algorithm as AES. The keysize is set by the number of bytes
686  # in the key argument you supply. So supply 32 bytes and you get AES with a 256-bit key.
687  check_mcrypt_exists();
688  $td = mcrypt_module_open(MCRYPT_RIJNDAEL_128, '', 'cbc', '');
689  if ($iv == "") {
690  # uncomment the following line to get a random iv for each call
691  $iv = mcrypt_create_iv(mcrypt_enc_get_iv_size($td), MCRYPT_RAND);
692  }
693 
694 
695  mcrypt_generic_init($td, $ckhexkey, $iv);
696  $mvi_data = bin2hex(mcrypt_generic($td, $mvi_query));
697  mcrypt_generic_deinit($td);
698  mcrypt_module_close($td);
699 
700  // alternative hexify
701  // $hexiv = bin2hex($iv);
702 
703  $hexiv = '';
704  for ($i = 0; $i < strlen($iv); $i++) {
705  $h = dechex(ord($iv[$i]));
706  $hexiv_this = substr('0' . $h, -2);
707  $hexiv .= $hexiv_this;
708  }
709 
710  $mvi_data .= $hexiv;
711  return $mvi_data;
712 }
713 
714 /**
715  * USED ONLY FOR TESTING
716  * TO BE DEPRECATED
717  */
718 function decrypt_mvi_mcrypt($mvi_cipher_iv, $ckhexkey) {
719  check_mcrypt_exists();
720  $td = mcrypt_module_open(MCRYPT_RIJNDAEL_128, '', 'cbc', '');
721  $iv_size = mcrypt_enc_get_iv_size($td); // 16
722 
723  $iv_hex = substr($mvi_cipher_iv, $iv_size * -2);
724  $mvi_cipher_hex = substr($mvi_cipher_iv, 0, $iv_size * -2);
725  $iv = hex2bin($iv_hex);
726 
727  mcrypt_generic_init($td, $ckhexkey, $iv);
728  $mvi_dec = mdecrypt_generic($td, hex2bin($mvi_cipher_hex));
729  mcrypt_generic_deinit($td);
730  mcrypt_module_close($td);
731 
732  return rtrim($mvi_dec, "\0");
733 }
734 
735 /**
736  * Encrypt MVI query using openssl
737  */
738 function encrypt_mvi_openssl($mvi_query, $ckhexkey, $iv="") {
739  try {
740  // padding -- blocksize of MCRYPT_RIJNDAEL_128 + MCRYPT_CBC is/was 16
741  $blocksize = openssl_cipher_iv_length(MVI_CIPHERMODE);
742  // add zero padding as per the specification
743  $mvi_query .= str_repeat("\0", $blocksize - (strlen($mvi_query) % $blocksize));
744  $openssl_enc = hcuOpenSSLEncrypt($mvi_query,
745  $ckhexkey,
746  MVI_CIPHERMODE,
747  THIRDPARTY_DEFAULT_AUTH_ALGO,
748  true,
749  $iv=$iv,
750  $context="connect_mvi");
751  $mvi_enc = bin2hex($openssl_enc["message"]);
752  $mvi_iv = bin2hex($openssl_enc["iv"]);
753 
754  return $mvi_enc.$mvi_iv;
755 
756  } catch (exception $ex) {
757  throw $ex;
758  }
759 }
760 
761 /**
762  * Used only for testing mvi query using openssl
763  */
764 function decrypt_mvi_openssl($mvi_cipher_iv, $ckhexkey) {
765  try {
766  // MCRYPT_RIJNDAEL_128 + MCRYPT_CBC = 16
767  $blocksize = openssl_cipher_iv_length(MVI_CIPHERMODE);
768  $iv_hex = substr($mvi_cipher_iv, $blocksize * -2);
769  $mvi_cipher_hex = substr($mvi_cipher_iv, 0, $blocksize * -2);
770 
771  $mvi_dec = hcuOpenSSLDecrypt(hex2bin($mvi_cipher_hex),
772  "",
773  $ckhexkey,
774  MVI_CIPHERMODE,
775  THIRDPARTY_DEFAULT_AUTH_ALGO,
776  true,
777  $iv=hex2bin($iv_hex),
778  $context="connect_mvi");
779 
780  return rtrim($mvi_dec, "\0");
781  } catch (exception $ex) {
782  throw $ex;
783  }
784 }
785 /**
786  * Encrypt SavvyMoney attribute using openssl
787  */
788 function encrypt_smo_openssl($smo_query, $smo_key) {
789  try {
790  $blocksize = openssl_cipher_iv_length(SAVVYMO_CIPHERMODE);
791  $pad = $blocksize - (strlen($smo_query) % $blocksize);
792  $smo_query = ($smo_query . str_repeat(chr($pad), $pad));
793  $smo_key = base64_decode($smo_key);
794  $iv='';
795  for ($i = 0; $i < $blocksize; $i++) {
796  $iv .= chr(0);
797  }
798 
799  $openssl_enc = hcuOpenSSLEncrypt($smo_query,
800  $smo_key,
801  SAVVYMO_CIPHERMODE,
802  THIRDPARTY_DEFAULT_AUTH_ALGO,
803  true,
804  $iv=$iv,
805  $context="connect_smo");
806  $smo_enc = base64_encode($openssl_enc["message"]);
807 
808  return $smo_enc;
809 
810  } catch (exception $ex) {
811  throw $ex;
812  }
813 }
814 
815 ?>
Generated by   doxygen 1.8.15