diff --git a/lib/PasswordLib/Random/Source/OpensslRandomPseudo.php b/lib/PasswordLib/Random/Source/OpensslRandomPseudo.php new file mode 100644 index 0000000..36e0596 --- /dev/null +++ b/lib/PasswordLib/Random/Source/OpensslRandomPseudo.php @@ -0,0 +1,92 @@ + + * @copyright 2011 The Authors + * @license http://www.opensource.org/licenses/mit-license.html MIT License + * @version Build @@version@@ + */ + +namespace PasswordLib\Random\Source; + +use PasswordLib\Core\Strength; + +/** + * The OpensslRandomPseudo Random Number Source + * + * This uses openssl_random_pseudo_bytes. This is suggested for use only with + * with php5-openssl compiled against LibreSSL: + * + * OpenSSL copying RNG state on fork: + * https://github.com/ramsey/uuid/issues/80#issuecomment-188286637 + * Fixed in LibreSSL: + * http://opensslrampage.org/post/91910269738/fix-for-the-libressl-prng-issue-under-linux + * + * Additionally, CVE-2015-8867 was fixed only in versions 5.6.12, 5.5.28, + * 5.4.44 and above: + * + * https://bugs.php.net/bug.php?id=70014 + * http://www.php.net/ChangeLog-5.php + * + * CVE-2015-8867 does not affect versions compiled against LibreSSL. + * + * @category PHPPasswordLib + * @package Random + * @subpackage Source + * @author Derek Marcotte <554b8425@razorfever.net> + * @codeCoverageIgnore + */ +class OpensslRandomPseudo implements \PasswordLib\Random\Source { + + /** + * Return an instance of Strength indicating the strength of the source + * + * @return Strength An instance of one of the strength classes + */ + public static function getStrength() { + if (!defined('OPENSSL_VERSION_TEXT')) { + return new Strength(Strength::VERYLOW); + } + if (!preg_match('/^LibreSSL/i', OPENSSL_VERSION_TEXT)) { + return new Strength(Strength::LOW); + } + return new Strength(Strength::MEDIUM); + } + + /** + * Generate a random string of the specified size + * + * @param int $size The size of the requested random string + * + * @return string A string of the requested size + */ + public function generate($size) { + if (!defined('OPENSSL_VERSION_TEXT')) { + return str_repeat(chr(0), $size); + } + return openssl_random_pseudo_bytes($size); + } + +}