Crypt

MMO\oauth · 1 symbol · generated 5 Oct 2026

class

Crypt

Configuration for the cryptographic functions

final class MMO\oauth\Crypt extends MMO\core\classes\aModule

Namespace: MMO\oauth
Extends: aModule

Index

	PBKDF2_ITERATIONS
	VERSION
	authentificationKey
	cipherAlgorithm
	encryptionKey
	hashAlgorithm
	ivSize
	keySize
	leeway
	opensslAlgorithm
	passwordCost
	passwordDigit
	passwordLength
	passwordLowcase
	passwordSpecial
	passwordTTL
	passwordUpcase
	tokenKey
	allowAnyPassword()
	clearToken()
	decrypt($key, $data)	Decrypt data
	decryptHash($key, $data)	Decrypt data in DER format using derivative keys
	derivativeHashKeys($key, $salt)	Generate derivative keys to be used as Public/Private keys
	encrypt($key, $data)	Encrypt data using AES256.
	encryptHash($key, $data)	Encrypt data in DER format using derivative keys
	generatePassword($excludes)	Generate a password
	generatePasswordCost()	This code will benchmark your server to determine how high of a cost you can afford.
	getCipherAlgorithm()
	getHashAlgorithm()
	getOpenSSLAlgorithm()
	getToken()
	passwordHash($pwd, $verify)	Create a hash for a password (so it is not stored directly)
	passwordNeedReset($passwordDate)
	passwordToKey($password, $salt)
	passwordVerify($pwd, $hash)	Verify that a password check its hash
	setCipherAlgorithm($algo)
	setHashAlgorithm($algo)
	setOpenSSLAlgorithm($algo)
	sign($privateKey, $msg, $algorithm)	Sign a string with a given key and algorithm.
	signHash($key, $msg)	Sign a hash
	storeToken($token)	Store token in the session.
	verify($publicKey, $msg, $signature, $algorithm)	Verify a signature with the message, key and method.
	verifyHash($key, $msg, $signature)	Verify a signature with the message and method.
	__wakeup()

Constants2

PBKDF2_ITERATIONS

const PBKDF2_ITERATIONS = 100000

VERSION

const VERSION = '2.0'

Properties16

authentificationKey

string $authentificationKey = 'MMO.oauth.Crypt.AuthenticationKey'

Type: string

cipherAlgorithm

#[MMO\core\attributes\Serialize(unserialize: 'setCipherAlgorithm')] protected string $cipherAlgorithm = 'aes-256-ctr'

Type: string

encryptionKey

string $encryptionKey = 'MMO.oauth.Crypt.EncryptionKey'

Type: string

hashAlgorithm

#[MMO\core\attributes\Serialize(unserialize: 'setHashAlgorithm')] protected string $hashAlgorithm = 'sha512'

Type: string

ivSize

int $ivSize = 16

Type: int

keySize

int $keySize = 32

Type: int

leeway

int $leeway = 0

Type: int

opensslAlgorithm

#[MMO\core\attributes\Serialize(unserialize: 'setOpenSSLAlgorithm')] protected string $opensslAlgorithm = 'sha256'

Type: string

passwordCost

?int $passwordCost = null

Type: null | int

passwordDigit

bool $passwordDigit = true

Type: bool

passwordLength

?int $passwordLength = null

Type: null | int

passwordLowcase

bool $passwordLowcase = true

Type: bool

passwordSpecial

bool $passwordSpecial = true

Type: bool

passwordTTL

string $passwordTTL = 'P6M'

Type: string

passwordUpcase

bool $passwordUpcase = true

Type: bool

tokenKey

string $tokenKey = 'oauth-bearer'

Type: string

Methods26

allowAnyPassword()

Crypt.php:92

function allowAnyPassword(): void

returns

void

clearToken()

Crypt.php:86

function clearToken(): void

returns

void

decrypt($key, $data)

Crypt.php:361

Decrypt data

function decrypt( OpenSSLAsymmetricKey|OpenSSLCertificate|MMO\oauth\keys\PrivateKey|array|string $key, string $data ): string

$key	OpenSSLAsymmetricKey \| OpenSSLCertificate \| PrivateKey \| array \| string	The secret key
$data	string
returns	string

decryptHash($key, $data)

Crypt.php:253

Decrypt data in DER format using derivative keys

function decryptHash(string $key, string $data): string|false

$key	string	the key to use
$data	string	the data to encrypt
returns	string \| false

derivativeHashKeys($key, $salt)

Crypt.php:218

Generate derivative keys to be used as Public/Private keys

function derivativeHashKeys(string $key, string $salt = ''): array

$key	string	the key to use
$salt = ''	string	a seed
returns	array	authentification key, encryption key

encrypt($key, $data)

Crypt.php:344

Encrypt data using AES256.

function encrypt(OpenSSLAsymmetricKey|MMO\oauth\keys\PublicKey $key, string $data): string

$key	OpenSSLAsymmetricKey \| PublicKey	The secret key
$data	string
returns	string	base 64 encoded string

encryptHash($key, $data)

Crypt.php:233

Encrypt data in DER format using derivative keys

function encryptHash(string $key, string $data): string

$key	string	the key to use
$data	string	the data to encrypt
returns	string	base 64 encoded string

generatePassword($excludes)

Crypt.php:158

Generate a password

function generatePassword(array $excludes = []): string

$excludes = []	array	list of passwords not to use (old ones)
returns	string

generatePasswordCost()

Crypt.php:197

This code will benchmark your server to determine how high of a cost you can afford. You want to set the highest cost that you can without slowing down you server too much. 8-10 is a good baseline, and more is good if your servers are fast enough. The code below aims for ≤ 50 milliseconds stretching time, which is a good baseline for systems handling interactive logins.

function generatePasswordCost(): int

returns

int

getCipherAlgorithm()

Crypt.php:389

function getCipherAlgorithm(): string

returns

string

getHashAlgorithm()

Crypt.php:380

function getHashAlgorithm(): string

returns

string

getOpenSSLAlgorithm()

Crypt.php:398

function getOpenSSLAlgorithm(): string

returns

string

getToken()

Crypt.php:82

function getToken(): ?MMO\oauth\helpers\JWT

returns

null | JWT

passwordHash($pwd, $verify)

Crypt.php:106

Create a hash for a password (so it is not stored directly)

function passwordHash(string $pwd, bool $verify = true): string

$pwd	string
$verify = true	bool	if true, check if password is secured enough
returns	string

passwordNeedReset($passwordDate)

Crypt.php:134

function passwordNeedReset(DateTimeInterface $passwordDate): bool

$passwordDate	DateTimeInterface
returns	bool

passwordToKey($password, $salt)

Crypt.php:149

function passwordToKey(string $password, string $salt = ''): string

$password	string
$salt = ''	string
returns	string

passwordVerify($pwd, $hash)

Crypt.php:145

Verify that a password check its hash

function passwordVerify(string $pwd, string $hash): bool

$pwd	string
$hash	string
returns	bool

setCipherAlgorithm($algo)

Crypt.php:384

function setCipherAlgorithm(string $algo): void

$algo	string
returns	void

setHashAlgorithm($algo)

Crypt.php:375

function setHashAlgorithm(string $algo): void

$algo	string
returns	void

setOpenSSLAlgorithm($algo)

Crypt.php:393

function setOpenSSLAlgorithm(string $algo): void

$algo	string
returns	void

sign($privateKey, $msg, $algorithm)

Crypt.php:305

Sign a string with a given key and algorithm.

function sign( OpenSSLAsymmetricKey|OpenSSLCertificate|array|string $privateKey, string $msg, ?string $algorithm = null ): string

$privateKey	OpenSSLAsymmetricKey \| OpenSSLCertificate \| array \| string	The secret key
$msg	string	The message to sign
$algorithm = null	null \| string
returns	string	An encrypted message

signHash($key, $msg)

Crypt.php:290

Sign a hash

function signHash(string $key, string $msg): string

$key	string
$msg	string	The message to sign
returns	string	An encrypted message
throws		Unsupported algorithm or bad key was specified

storeToken($token)

Crypt.php:74

Store token in the session.

function storeToken(MMO\oauth\helpers\JWT|MMO\oauth\interfaces\iToken|null $token): void

NOTE: if you have generated a refresh token, store this one instead of the normal token.

$token	JWT \| iToken \| null
returns	void

verify($publicKey, $msg, $signature, $algorithm)

Crypt.php:330

Verify a signature with the message, key and method. Not all methods are symmetric, so we must have a separate verify and sign method.

function verify( OpenSSLAsymmetricKey|OpenSSLCertificate|array|string $publicKey, string $msg, string $signature, ?string $algorithm = null ): bool

$publicKey	OpenSSLAsymmetricKey \| OpenSSLCertificate \| array \| string	For HS, a string key works. for RS, must be a resource of an openssl public key
$msg	string	The original message (header and body)
$signature	string	The original signature
$algorithm = null	null \| string
returns	bool

verifyHash($key, $msg, $signature)

Crypt.php:279

Verify a signature with the message and method.

function verifyHash(string $key, string $msg, string $signature): bool

$key	string	the key to use
$msg	string	The original message (header and body)
$signature	string	The original signature
returns	bool

__wakeup()

Crypt.php:64

function __wakeup(): void

returns

void

Inherited members (48)

Constants	Declared by	Description
`ALERT`	iLogLevel	Alert: Action must be taken immediately.
`ALL`	iLogLevel	Mask for all
`ALL_PLUS`	iLogLevel	debug everything
`BACKTRACE`	iLogLevel
`CRITICAL`	iLogLevel	Critical: Critical conditions.
`DEBUG`	iLogLevel	Debug: Detailed debug information.
`DEEP`	iLogLevel	debug everything with arguments
`EMERGENCY`	iLogLevel	Emergency: System is unusable.
`ERROR`	iLogLevel	Error: Runtime errors that do not require immediate action but should typically be logged and monitored.
`ERROR_PLUS`	iLogLevel	Mask for all error
`FATAL`	iLogLevel	Mask for all fatal error
`INFO`	iLogLevel	Info: Interesting events.
`INFO_PLUS`	iLogLevel	Mask for all errors/warning/notices/info
`MEMORY`	iLogLevel	include backtrace object
`NOTICE`	iLogLevel	Notice: Normal but significant events.
`NOTICE_PLUS`	iLogLevel	Mask for all errors/warning/notices/info
`TRACE`	iLogLevel	include backtrace as origins
`WARNING`	iLogLevel	Warning: Exceptional occurrences that are not errors.
`WARNING_PLUS`	iLogLevel	Mask for all errors and warnings

	Properties	Declared by	Description
	`verbosity`	aModule

Methods	Declared by	Description
`alert($message, $context)`	aModule	Action must be taken immediately.
`backtraces($message, $context)`	aModule	Force-log a message at INFO level together with a full stack trace/memory snapshot (`iLogLevel::BACKTRACE`), bypassing the verbosity mask entirely (any non-zero verbosity is enough to trigger it).
`Configure($config)`	aModule	Merge $config into this module's configuration in the shared `Configuration`.
`critical($message, $context)`	aModule	Critical conditions. No-op if CRITICAL is currently filtered out by the verbosity mask.
`debug($message, $context)`	aModule	Detailed debug information.
`debugName()`	aModule	Human-readable identifier used as the default `{origin}` in this instance's log messages.
`DefaultConfig()`	aModule	The config a module starts from before anything loaded via `Configuration` is merged in.
`emergency($message, $context)`	aModule	System is unusable. No-op if EMERGENCY is currently filtered out by the verbosity mask.
`error($message, $context)`	aModule	Runtime errors that do not require immediate action but should typically be logged and monitored.
`getVerbosity()`	aModule
`info($message, $context)`	aModule	Interesting events. No-op if INFO is currently filtered out by the verbosity mask.
`Instantiate($config)`	aModule	(Re)create the shared instance immediately, configured with $config merged into the class's existing config.
`IsShared()`	aModule
`log($level, $message, $context)`	aModule	Logs with an arbitrary level.
`notice($message, $context)`	aModule	Normal but significant events.
`offsetExists($key)`	aModule	\ArrayAccess::offsetExists -- tells whether $key is a declared property at all, regardless of whether it is currently readable/writable through array access.
`offsetGet($key)`	aModule	\ArrayAccess::offsetGet -- reads a property directly, unless it has a `#[Serialize(serialize: 'methodName')]` attribute, in which case that zero-argument method is called instead (e.g.
`offsetSet($key, $value)`	aModule	\ArrayAccess::offsetSet -- sets a property directly, unless it has a `#[Serialize(unserialize: 'methodName')]` attribute, in which case that method is called with $value instead (e.g.
`offsetUnset($key)`	aModule	\ArrayAccess::offsetUnset -- equivalent to `$module[$key] = null`.
`serialize($path, $serializer)`	aModule	\MMO\core\interfaces\iSerializable::serialize -- exports every property (via
`setVerbosity($verb)`	aModule	Set the current verbosity mask, replacing whatever it was before.
`Shared()`	aModule	Get the shared instance, creating (and configuring) it on first call.
`testVerbosity($level)`	aModule	Test whether a given level (or set of levels) is currently enabled by this instance's verbosity mask.
`traitUnshare($serialize)`	aModule	Remove the shared instance, so the next `Shared()` call creates a fresh one.
`unserialize($data, $path, $instances)`	aModule	\MMO\core\interfaces\iSerializable::unserialize -- merges $data onto `DefaultConfig`, runs it through the (possibly overridden) constructor, then applies each resulting value to its property (via
`Unshare($serialize)`	aModule	Like `tSingleton::Unshare`, but also disconnects this module's instance from every event it was listening to (via `Event::DisconnectListeners`) before dropping it.
`warning($message, $context)`	aModule	Exceptional occurrences that are not errors.
`__construct($config)`	aModule	protected constructor, so it is not possible to do `new Module(...)` called by the serialization process just before being injected with data.