doupingyun73833 2014-01-10 20:36
浏览 221
已采纳

PHP openssl_pkcs7_ *需要文件,安全问题

I want to use these openssl_pkcs7_* functions to verify, sign, encrypt and decrypt mails. I realized that these functions only accept filenames for the "keyfile", the certificate or the "mail" itself.

Imho thats a big security issue since there could be issues causing temporary files created for these files not being deleted. In that case, system operators, e.g. could read the encrypted message because its somewhere in the filesystem temporarily.

Now, I just want you guys to ask if any of you has an idea how I could "fake" a file on linux. e.g. using some /dev/ device like /dev/stdin or something like that. Any idea? Would be awesome.

These "files" should be read- and writable by "www-data".

Hope you guys have some amazing ideas for me.

With best regards, Max

EDIT: "tmpfile" is a physically located file, there is no 100% guarantee of deletion tho.

EDIT2: Well, I am actually thinking about creating a socket (AF_UNIX and a socket-File) and let openssl write to it since its executed from the same process. But I dont get this to work, any suggestions?

  • 写回答

2条回答 默认 最新

  • dtsc1684 2014-01-12 02:02
    关注

    I want to use these openssl_pkcs7_* functions to verify, sign, encrypt and decrypt mails.

    The problem seems to be the choice of PHP's functions (or PHP's OpenSSL offerings). Perhaps you should use something else, like a library that provides what you need.


    Here's what is really available from OpenSSL. From PKCS7_encrypt(3):

    PKCS7 *PKCS7_encrypt(STACK_OF(X509) *certs, BIO *in, const EVP_CIPHER *cipher, int flags);
    

    You use a BIO for the in-data, and that can be a memory BIO. There's no reason to write a disk file.

    You have similar for PKCS7_decrypt(3):

    int PKCS7_decrypt(PKCS7 *p7, EVP_PKEY *pkey, X509 *cert, BIO *data, int flags);
    

    Now, for the keys. The keys can be read (and written) using BIOs too. That means they can use a memory bio. But I'm not sure how useful that would be since the keys have to be stored somewhere.

    For the reference, see pem(3). There's almost too many functions to list:

    PEM, PEM_read_bio_PrivateKey, PEM_read_PrivateKey, PEM_write_bio_PrivateKey, PEM_write_PrivateKey, PEM_write_bio_PKCS8PrivateKey, PEM_write_PKCS8PrivateKey, PEM_write_bio_PKCS8PrivateKey_nid, PEM_write_PKCS8PrivateKey_nid, PEM_read_bio_PUBKEY, PEM_read_PUBKEY, PEM_write_bio_PUBKEY, PEM_write_PUBKEY, PEM_read_bio_RSAPrivateKey, PEM_read_RSAPrivateKey, PEM_write_bio_RSAPrivateKey, PEM_write_RSAPrivateKey, PEM_read_bio_RSAPublicKey, PEM_read_RSAPublicKey, PEM_write_bio_RSAPublicKey, PEM_write_RSAPublicKey, PEM_read_bio_RSA_PUBKEY, PEM_read_RSA_PUBKEY, PEM_write_bio_RSA_PUBKEY, PEM_write_RSA_PUBKEY, PEM_read_bio_DSAPrivateKey, PEM_read_DSAPrivateKey, PEM_write_bio_DSAPrivateKey, PEM_write_DSAPrivateKey, PEM_read_bio_DSA_PUBKEY, PEM_read_DSA_PUBKEY, PEM_write_bio_DSA_PUBKEY, PEM_write_DSA_PUBKEY, PEM_read_bio_DSAparams, PEM_read_DSAparams, PEM_write_bio_DSAparams, PEM_write_DSAparams, PEM_read_bio_DHparams, PEM_read_DHparams, PEM_write_bio_DHparams, PEM_write_DHparams, PEM_read_bio_X509, PEM_read_X509, PEM_write_bio_X509, PEM_write_X509, PEM_read_bio_X509_AUX, PEM_read_X509_AUX, PEM_write_bio_X509_AUX, PEM_write_X509_AUX, PEM_read_bio_X509_REQ, PEM_read_X509_REQ, PEM_write_bio_X509_REQ, PEM_write_X509_REQ, PEM_write_bio_X509_REQ_NEW, PEM_write_X509_REQ_NEW, PEM_read_bio_X509_CRL, PEM_read_X509_CRL, PEM_write_bio_X509_CRL, PEM_write_X509_CRL, PEM_read_bio_PKCS7, PEM_read_PKCS7, PEM_write_bio_PKCS7, PEM_write_PKCS7, PEM_read_bio_NETSCAPE_CERT_SEQUENCE, PEM_read_NETSCAPE_CERT_SEQUENCE, PEM_write_bio_NETSCAPE_CERT_SEQUENCE, PEM_write_NETSCAPE_CERT_SEQUENCE


    If you find something that offers more of OpenSSL, you might look into the CMS_* functions, too. They are easy to work with, too.

    You can see examples of how to use them in <openssl dir>/demos/cms_enc.c, <openssl dir>/demos/cms_dec.c, <openssl dir>/demos/cms_sign.c and <openssl dir>/demos/cms_verify.c.

    Two of the functions of interest are:

    CMS_ContentInfo *CMS_encrypt(STACK_OF(X509) *certs, BIO *in, const EVP_CIPHER *cipher, unsigned int flags);
    

    and

    int CMS_decrypt(CMS_ContentInfo *cms, EVP_PKEY *pkey, X509 *cert, BIO *dcont, BIO *out, unsigned int flags);
    
    本回答被题主选为最佳回答 , 对您是否有帮助呢?
    评论
查看更多回答(1条)

报告相同问题?

悬赏问题

  • ¥15 求差集那个函数有问题,有无佬可以解决
  • ¥15 【提问】基于Invest的水源涵养
  • ¥20 微信网友居然可以通过vx号找到我绑的手机号
  • ¥15 寻一个支付宝扫码远程授权登录的软件助手app
  • ¥15 解riccati方程组
  • ¥15 display:none;样式在嵌套结构中的已设置了display样式的元素上不起作用?
  • ¥15 使用rabbitMQ 消息队列作为url源进行多线程爬取时,总有几个url没有处理的问题。
  • ¥15 Ubuntu在安装序列比对软件STAR时出现报错如何解决
  • ¥50 树莓派安卓APK系统签名
  • ¥65 汇编语言除法溢出问题