includes/utils/MWCryptRand.php

   1 <?php
   2 /**
   3  * A cryptographic random generator class used for generating secret keys
   4  *
   5  * This is based in part on Drupal code as well as what we used in our own code
   6  * prior to introduction of this class.
   7  *
   8  * This program is free software; you can redistribute it and/or modify
   9  * it under the terms of the GNU General Public License as published by
  10  * the Free Software Foundation; either version 2 of the License, or
  11  * (at your option) any later version.
  12  *
  13  * This program is distributed in the hope that it will be useful,
  14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  16  * GNU General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU General Public License along
  19  * with this program; if not, write to the Free Software Foundation, Inc.,
  20  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
  21  * http://www.gnu.org/copyleft/gpl.html
  22  *
  23  * @author Daniel Friesen
  24  * @file
  25  */
  26
  27 use MediaWiki\MediaWikiServices;
  28
  29 class MWCryptRand {
  30         /**
  31          * @deprecated since 1.32
  32          * @return CryptRand
  33          */
  34         protected static function singleton() {
  35                 wfDeprecated( __METHOD__, '1.32' );
  36                 return MediaWikiServices::getInstance()->getCryptRand();
  37         }
  38
  39         /**
  40          * Return a boolean indicating whether or not the source used for cryptographic
  41          * random bytes generation in the previously run generate* call
  42          * was cryptographically strong.
  43          *
  44          * @deprecated since 1.32, always returns true
  45          *
  46          * @return bool Always true
  47          */
  48         public static function wasStrong() {
  49                 wfDeprecated( __METHOD__, '1.32' );
  50                 return true;
  51         }
  52
  53         /**
  54          * Generate a run of cryptographically random data and return
  55          * it in raw binary form.
  56          *
  57          * @deprecated since 1.32, use random_bytes()
  58          *
  59          * @param int $bytes The number of bytes of random data to generate
  60          * @return string Raw binary random data
  61          */
  62         public static function generate( $bytes ) {
  63                 wfDeprecated( __METHOD__, '1.32' );
  64                 return random_bytes( floor( $bytes ) );
  65         }
  66
  67         /**
  68          * Generate a run of cryptographically random data and return
  69          * it in hexadecimal string format.
  70          *
  71          * @param int $chars The number of hex chars of random data to generate
  72          * @return string Hexadecimal random data
  73          */
  74         public static function generateHex( $chars ) {
  75                 // hex strings are 2x the length of raw binary so we divide the length in half
  76                 // odd numbers will result in a .5 that leads the generate() being 1 character
  77                 // short, so we use ceil() to ensure that we always have enough bytes
  78                 $bytes = ceil( $chars / 2 );
  79                 // Generate the data and then convert it to a hex string
  80                 $hex = bin2hex( random_bytes( $bytes ) );
  81
  82                 // A bit of paranoia here, the caller asked for a specific length of string
  83                 // here, and it's possible (eg when given an odd number) that we may actually
  84                 // have at least 1 char more than they asked for. Just in case they made this
  85                 // call intending to insert it into a database that does truncation we don't
  86                 // want to give them too much and end up with their database and their live
  87                 // code having two different values because part of what we gave them is truncated
  88                 // hence, we strip out any run of characters longer than what we were asked for.
  89                 return substr( $hex, 0, $chars );
  90         }
  91 }