From 0963acafcfcab6ea7dfdb33769218594467b889c Mon Sep 17 00:00:00 2001 From: cypherbits Date: Sat, 2 May 2020 12:16:36 +0200 Subject: [PATCH] New generation AES256-GCM encryption by libsodium. PHP >= 7.3 needed. --- chat.php | 43 ++++++++++++++++++++++++++++++------------- 1 file changed, 30 insertions(+), 13 deletions(-) diff --git a/chat.php b/chat.php index c438f42..2793c4f 100644 --- a/chat.php +++ b/chat.php @@ -768,7 +768,8 @@ function restore_backup($C){ $note['type']=1; } if(MSGENCRYPTED){ - $note['text']=openssl_encrypt($note['text'], 'aes-256-cbc', ENCRYPTKEY, 0, '1234567890123456'); + //$note['text']=openssl_encrypt($note['text'], 'aes-256-cbc', ENCRYPTKEY, 0, '1234567890123456'); + $note['text']=base64_encode(sodium_crypto_aead_aes256gcm_encrypt($note['text'], '', AES_IV, ENCRYPTKEY)); } $stmt->execute([$note['type'], $note['lastedited'], $note['editedby'], $note['text']]); } @@ -804,7 +805,8 @@ function send_backup($C){ $result=$db->query('SELECT * FROM ' . PREFIX . "notes;"); while($note=$result->fetch(PDO::FETCH_ASSOC)){ if(MSGENCRYPTED){ - $note['text']=openssl_decrypt($note['text'], 'aes-256-cbc', ENCRYPTKEY, 0, '1234567890123456'); + //$note['text']=openssl_decrypt($note['text'], 'aes-256-cbc', ENCRYPTKEY, 0, '1234567890123456'); + $note['text']=sodium_crypto_aead_aes256gcm_decrypt(base64_decode($note['text']), null, AES_IV, ENCRYPTKEY); } $code['notes'][]=$note; } @@ -1539,7 +1541,8 @@ function send_notes($type){ } if(isset($_REQUEST['text'])){ if(MSGENCRYPTED){ - $_REQUEST['text']=openssl_encrypt($_REQUEST['text'], 'aes-256-cbc', ENCRYPTKEY, 0, '1234567890123456'); + //$_REQUEST['text']=openssl_encrypt($_REQUEST['text'], 'aes-256-cbc', ENCRYPTKEY, 0, '1234567890123456'); + $_REQUEST['text']=base64_encode(sodium_crypto_aead_aes256gcm_encrypt($_REQUEST['text'], '', AES_IV, ENCRYPTKEY)); } $time=time(); $stmt=$db->prepare('INSERT INTO ' . PREFIX . 'notes (type, lastedited, editedby, text) VALUES (?, ?, ?, ?);'); @@ -1573,7 +1576,8 @@ function send_notes($type){ $note['text']=''; } if(MSGENCRYPTED){ - $note['text']=openssl_decrypt($note['text'], 'aes-256-cbc', ENCRYPTKEY, 0, '1234567890123456'); + //$note['text']=openssl_decrypt($note['text'], 'aes-256-cbc', ENCRYPTKEY, 0, '1234567890123456'); + $note['text']=sodium_crypto_aead_aes256gcm_decrypt(base64_decode($note['text']), null, AES_IV, ENCRYPTKEY); } echo "

".form('notes'); echo "$hiddendo
'; @@ -2932,7 +2936,8 @@ function validate_input(){ 'text' =>"$displaysend".style_this($message, $U['style']).'' ]; if(MSGENCRYPTED){ - $newmessage['text']=openssl_encrypt($newmessage['text'], 'aes-256-cbc', ENCRYPTKEY, 0, '1234567890123456'); + //$newmessage['text']=openssl_encrypt($newmessage['text'], 'aes-256-cbc', ENCRYPTKEY, 0, '1234567890123456'); + $newmessage['text']=base64_encode(sodium_crypto_aead_aes256gcm_encrypt($newmessage['text'], '', AES_IV, ENCRYPTKEY)); } $stmt=$db->prepare('INSERT INTO ' . PREFIX . 'inbox (postdate, postid, poster, recipient, text) VALUES(?, ?, ?, ?, ?)'); $stmt->execute([$newmessage['postdate'], $id[0], $newmessage['poster'], $newmessage['recipient'], $newmessage['text']]); @@ -3120,7 +3125,8 @@ function add_system_message($mes){ function write_message($message){ global $db; if(MSGENCRYPTED){ - $message['text']=openssl_encrypt($message['text'], 'aes-256-cbc', ENCRYPTKEY, 0, '1234567890123456'); + //$message['text']=openssl_encrypt($message['text'], 'aes-256-cbc', ENCRYPTKEY, 0, '1234567890123456'); + $message['text']=base64_encode(sodium_crypto_aead_aes256gcm_encrypt($message['text'], '', AES_IV, ENCRYPTKEY)); } $stmt=$db->prepare('INSERT INTO ' . PREFIX . 'messages (postdate, poststatus, poster, recipient, text, delstatus) VALUES (?, ?, ?, ?, ?, ?);'); $stmt->execute([$message['postdate'], $message['poststatus'], $message['poster'], $message['recipient'], $message['text'], $message['delstatus']]); @@ -3241,7 +3247,8 @@ function print_messages($delstatus=0){ function prepare_message_print(&$message, $removeEmbed){ if(MSGENCRYPTED){ - $message['text']=openssl_decrypt($message['text'], 'aes-256-cbc', ENCRYPTKEY, 0, '1234567890123456'); + //$message['text']=openssl_decrypt($message['text'], 'aes-256-cbc', ENCRYPTKEY, 0, '1234567890123456'); + $message['text']=sodium_crypto_aead_aes256gcm_decrypt(base64_decode($message['text']), null, AES_IV, ENCRYPTKEY); } if($removeEmbed){ $message['text']=preg_replace_callback('/<\/a>/u', @@ -4006,9 +4013,11 @@ function update_db(){ $stmt=$db->prepare('UPDATE ' . PREFIX . 'messages SET text=? WHERE id=?;'); while($message=$result->fetch(PDO::FETCH_ASSOC)){ if(MSGENCRYPTED){ - $message['text']=openssl_encrypt($message['text'], 'aes-256-cbc', ENCRYPTKEY, 0, '1234567890123456'); + //$message['text']=openssl_encrypt($message['text'], 'aes-256-cbc', ENCRYPTKEY, 0, '1234567890123456'); + $message['text']=base64_encode(sodium_crypto_aead_aes256gcm_encrypt($message['text'], '', AES_IV, ENCRYPTKEY)); }else{ - $message['text']=openssl_decrypt($message['text'], 'aes-256-cbc', ENCRYPTKEY, 0, '1234567890123456'); + //$message['text']=openssl_decrypt($message['text'], 'aes-256-cbc', ENCRYPTKEY, 0, '1234567890123456'); + $message['text']=sodium_crypto_aead_aes256gcm_decrypt(base64_decode($message['text']), null, AES_IV, ENCRYPTKEY); } $stmt->execute([$message['text'], $message['id']]); } @@ -4016,9 +4025,11 @@ function update_db(){ $stmt=$db->prepare('UPDATE ' . PREFIX . 'notes SET text=? WHERE id=?;'); while($message=$result->fetch(PDO::FETCH_ASSOC)){ if(MSGENCRYPTED){ - $message['text']=openssl_encrypt($message['text'], 'aes-256-cbc', ENCRYPTKEY, 0, '1234567890123456'); + //$message['text']=openssl_encrypt($message['text'], 'aes-256-cbc', ENCRYPTKEY, 0, '1234567890123456'); + $message['text']=base64_encode(sodium_crypto_aead_aes256gcm_encrypt($message['text'], '', AES_IV, ENCRYPTKEY)); }else{ - $message['text']=openssl_decrypt($message['text'], 'aes-256-cbc', ENCRYPTKEY, 0, '1234567890123456'); + //$message['text']=openssl_decrypt($message['text'], 'aes-256-cbc', ENCRYPTKEY, 0, '1234567890123456'); + $message['text']=sodium_crypto_aead_aes256gcm_decrypt(base64_decode($message['text']), null, AES_IV, ENCRYPTKEY); } $stmt->execute([$message['text'], $message['id']]); } @@ -4177,10 +4188,11 @@ function load_lang(){ function load_config(){ mb_internal_encoding('UTF-8'); - define('VERSION', '1.23.7'); // Script version + define('VERSION', '1.24'); // Script version define('DBVERSION', 42); // Database layout version define('MSGENCRYPTED', false); // Store messages encrypted in the database to prevent other database users from reading them - true/false - visit the setup page after editing! - define('ENCRYPTKEY', 'MY_KEY'); // Encryption key for messages + define('ENCRYPTKEY', 'MY_SECRET_KEY'); // Encryption key for messages + define('AES_IV', '1234567890123456'); //AES Encryption IV define('DBHOST', 'localhost'); // Database host define('DBUSER', 'www-data'); // Database user define('DBPASS', 'YOUR_DB_PASS'); // Database password @@ -4198,4 +4210,9 @@ function load_config(){ } define('COOKIENAME', PREFIX . 'chat_session'); // Cookie name storing the session information define('LANG', 'en'); // Default language + if (MSGENCRYPTED){ + //Do not touch: Compute real keys needed by encryption functions + define('ENCRYPTKEY', substr(hash("sha512/256",ENCRYPTKEY),0, SODIUM_CRYPTO_AEAD_AES256GCM_KEYBYTES)); + define('AES_IV', substr(hash("sha512/256",AES_IV), 0, SODIUM_CRYPTO_AEAD_AES256GCM_NPUBBYTES)); + } }