Kriptografiya asoslari

// libsodium - zamonaviy va xavfsiz
final class Shifrlovchi
{
    public function __construct(private string $kalit)
    {
        if (strlen($kalit) !== SODIUM_CRYPTO_SECRETBOX_KEYBYTES) {
            throw new InvalidArgumentException('Kalit 32 bayt bo\'lishi kerak');
        }
    }

    public static function kalitYarating(): string
    {
        return sodium_crypto_secretbox_keygen();
    }

    public function shifrlang(string $matn): string
    {
        $nonce = random_bytes(SODIUM_CRYPTO_SECRETBOX_NONCEBYTES);
        $shifr = sodium_crypto_secretbox($matn, $nonce, $this->kalit);

        return base64_encode($nonce . $shifr);
    }

    public function ochiring(string $shifrlangan): string
    {
        $malumot = base64_decode($shifrlangan, true)
            ?: throw new ShifrlashXatosi('Noto\'g\'ri format');

        if (strlen($malumot) < SODIUM_CRYPTO_SECRETBOX_NONCEBYTES) {
            throw new ShifrlashXatosi('Ma\'lumot juda qisqa');
        }

        $nonce = substr($malumot, 0, SODIUM_CRYPTO_SECRETBOX_NONCEBYTES);
        $shifr = substr($malumot, SODIUM_CRYPTO_SECRETBOX_NONCEBYTES);

        $natija = sodium_crypto_secretbox_open($shifr, $nonce, $this->kalit);

        if ($natija === false) {
            throw new ShifrlashXatosi('Ochib bo\'lmadi - kalit yoki ma\'lumot noto\'g\'ri');
        }

        return $natija;
    }
}

$kalit = Shifrlovchi::kalitYarating();
$shifrlovchi = new Shifrlovchi($kalit);

$shifrlangan = $shifrlovchi->shifrlang('Maxfiy ma\'lumot');
echo $shifrlangan . "\n";
echo $shifrlovchi->ochiring($shifrlangan);

# Kalit juftligini yaratish
openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:4096 -out maxfiy.pem
openssl rsa -pubout -in maxfiy.pem -out ochiq.pem

# Ed25519 - zamonaviy va tezroq
ssh-keygen -t ed25519 -C "[email protected]"

$matn = 'Salom, dunyo!';

echo hash('sha256', $matn) . "\n";
echo hash('sha256', 'Salom, dunyo?') . "\n";

sha256sum ubuntu-24.04.iso

function faylYaxlitmi(string $yol, string $kutilganXesh): bool
{
    return hash_equals($kutilganXesh, hash_file('sha256', $yol));
}

// Xabar haqiqiyligini tekshirish
$imzo = hash_hmac('sha256', $tana, $maxfiySir);

// Tekshirish
if (!hash_equals($imzo, $kelganImzo)) {
    throw new NotogriImzo();
}

// Ed25519 - zamonaviy imzo
$juftlik = sodium_crypto_sign_keypair();
$maxfiy  = sodium_crypto_sign_secretkey($juftlik);
$ochiq   = sodium_crypto_sign_publickey($juftlik);

$xabar = 'Buyurtma #1042 tasdiqlandi';
$imzo = sodium_crypto_sign_detached($xabar, $maxfiy);

// Tekshirish (faqat ochiq kalit kerak)
$togrimi = sodium_crypto_sign_verify_detached($imzo, $xabar, $ochiq);

var_dump($togrimi);

# Let's Encrypt bilan bepul sertifikat
sudo certbot --nginx -d dokon.uz -d www.dokon.uz

# Sertifikatni tekshirish
openssl s_client -connect dokon.uz:443 -servername dokon.uz < /dev/null 2>/dev/null | openssl x509 -noout -dates

server {
    listen 443 ssl http2;
    server_name dokon.uz;

    ssl_certificate     /etc/letsencrypt/live/dokon.uz/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/dokon.uz/privkey.pem;

    # Faqat zamonaviy protokollar
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers off;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384;

    # OCSP stapling
    ssl_stapling on;
    ssl_stapling_verify on;

    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
}

# HTTP dan HTTPS ga yo'naltirish
server {
    listen 80;
    server_name dokon.uz www.dokon.uz;
    return 301 https://$host$request_uri;
}

// XAVFLI - bashorat qilish mumkin
$token = rand();
$token = mt_rand();
$token = uniqid();

// XAVFSIZ - kriptografik jihatdan xavfsiz
$token = bin2hex(random_bytes(32));
$son   = random_int(100000, 999999);

// Xavfsiz token yaratish
final class TokenYaratuvchi
{
    public static function yarating(int $baytlar = 32): string
    {
        return bin2hex(random_bytes($baytlar));
    }

    public static function tasdiqlashKodi(): string
    {
        return str_pad((string) random_int(0, 999999), 6, '0', STR_PAD_LEFT);
    }
}

// Kalit versiyalash - rotatsiya uchun
final class KalitBoshqaruvchi
{
    /** @var array<int, string> */
    private array $kalitlar;
    private int $joriyVersiya;

    public function shifrlang(string $matn): string
    {
        $shifr = $this->shifrlovchi($this->joriyVersiya)->shifrlang($matn);

        // Versiyani prefiks sifatida saqlaymiz
        return "v{$this->joriyVersiya}:{$shifr}";
    }

    public function ochiring(string $shifrlangan): string
    {
        [$versiyaQismi, $shifr] = explode(':', $shifrlangan, 2);
        $versiya = (int) ltrim($versiyaQismi, 'v');

        return $this->shifrlovchi($versiya)->ochiring($shifr);
    }
}