100 lines
2.8 KiB
PHP
100 lines
2.8 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace Jose\Component\KeyManagement\Analyzer;
|
|
|
|
use Jose\Component\Core\JWK;
|
|
use Jose\Component\Core\Util\Base64UrlSafe;
|
|
use Override;
|
|
use SensitiveParameter;
|
|
use function count;
|
|
use function is_string;
|
|
use function strlen;
|
|
|
|
final readonly class ZxcvbnKeyAnalyzer implements KeyAnalyzer
|
|
{
|
|
public const STRENGTH_VERY_WEAK = 0;
|
|
|
|
public const STRENGTH_WEAK = 1;
|
|
|
|
public const STRENGTH_MEDIUM = 2;
|
|
|
|
public const STRENGTH_STRONG = 3;
|
|
|
|
public const STRENGTH_VERY_STRONG = 4;
|
|
|
|
#[Override]
|
|
public function analyze(JWK $jwk, MessageBag $bag): void
|
|
{
|
|
if ($jwk->get('kty') !== 'oct') {
|
|
return;
|
|
}
|
|
$k = $jwk->get('k');
|
|
if (! is_string($k)) {
|
|
$bag->add(Message::high('The key is not valid'));
|
|
|
|
return;
|
|
}
|
|
$k = Base64UrlSafe::decodeNoPadding($k);
|
|
$strength = self::estimateStrength($k);
|
|
switch (true) {
|
|
case $strength < 3:
|
|
$bag->add(
|
|
Message::high(
|
|
'The octet string is weak and easily guessable. Please change your key as soon as possible.'
|
|
)
|
|
);
|
|
|
|
break;
|
|
|
|
case $strength === 3:
|
|
$bag->add(Message::medium('The octet string is safe, but a longer key is preferable.'));
|
|
|
|
break;
|
|
|
|
default:
|
|
break;
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Returns the estimated strength of a password.
|
|
*
|
|
* The higher the value, the stronger the password.
|
|
*
|
|
* @return self::STRENGTH_*
|
|
*/
|
|
private static function estimateStrength(#[SensitiveParameter] string $password): int
|
|
{
|
|
if (! $length = strlen($password)) {
|
|
return self::STRENGTH_VERY_WEAK;
|
|
}
|
|
$password = count_chars($password, 1);
|
|
$chars = count($password);
|
|
|
|
$control = $digit = $upper = $lower = $symbol = $other = 0;
|
|
foreach ($password as $chr => $count) {
|
|
match (true) {
|
|
$chr < 32 || $chr === 127 => $control = 33,
|
|
$chr >= 48 && $chr <= 57 => $digit = 10,
|
|
$chr >= 65 && $chr <= 90 => $upper = 26,
|
|
$chr >= 97 && $chr <= 122 => $lower = 26,
|
|
$chr >= 128 => $other = 128,
|
|
default => $symbol = 33,
|
|
};
|
|
}
|
|
|
|
$pool = $lower + $upper + $digit + $symbol + $control + $other;
|
|
$entropy = $chars * log($pool, 2) + ($length - $chars) * log($chars, 2);
|
|
|
|
return match (true) {
|
|
$entropy >= 120 => self::STRENGTH_VERY_STRONG,
|
|
$entropy >= 100 => self::STRENGTH_STRONG,
|
|
$entropy >= 80 => self::STRENGTH_MEDIUM,
|
|
$entropy >= 60 => self::STRENGTH_WEAK,
|
|
default => self::STRENGTH_VERY_WEAK,
|
|
};
|
|
}
|
|
}
|