* Add support for custom RNG providers

* Custom exception types for QR providers and RNG providers

RobThree/TwoFactorAuth/Providers/Qr/BaseHTTPQRCodeProvider.php

@@ -1,6 +1,6 @@
 <?php
 
-namespace RobThree\TwoFactorAuth\Providers;
+namespace RobThree\TwoFactorAuth\Providers\Qr;
 
 abstract class BaseHTTPQRCodeProvider implements IQRCodeProvider
 {

RobThree/TwoFactorAuth/Providers/Qr/GoogleQRCodeProvider.php

@@ -1,6 +1,6 @@
 <?php
 
-namespace RobThree\TwoFactorAuth\Providers;
+namespace RobThree\TwoFactorAuth\Providers\Qr;
 
 // https://developers.google.com/chart/infographics/docs/qr_codes
 class GoogleQRCodeProvider extends BaseHTTPQRCodeProvider 
@@ -11,7 +11,7 @@ class GoogleQRCodeProvider extends BaseHTTPQRCodeProvider
     function __construct($verifyssl = false, $errorcorrectionlevel = 'L', $margin = 1) 
     {
         if (!is_bool($verifyssl))
-            throw new Exception('VerifySSL must be bool');
+            throw new QRException('VerifySSL must be bool');
 
         $this->verifyssl = $verifyssl;
         

RobThree/TwoFactorAuth/Providers/Qr/IQRCodeProvider.php

@@ -1,6 +1,6 @@
 <?php
 
-namespace RobThree\TwoFactorAuth\Providers;
+namespace RobThree\TwoFactorAuth\Providers\Qr;
 
 interface IQRCodeProvider
 {

RobThree/TwoFactorAuth/Providers/Qr/QRException.php

@@ -0,0 +1,11 @@
+<?php
+
+namespace RobThree\TwoFactorAuth\Providers\Qr;
+
+class QRException extends \Exception
+{
+    function __construct($message = "", $code = 0, $exception = null)
+    {
+    	parent::__construct($message, $code, $exception);
+    }
+}

RobThree/TwoFactorAuth/Providers/Qr/QRServerProvider.php

@@ -1,6 +1,6 @@
 <?php
 
-namespace RobThree\TwoFactorAuth\Providers;
+namespace RobThree\TwoFactorAuth\Providers\Qr;
 
 // http://goqr.me/api/doc/create-qr-code/
 class QRServerProvider extends BaseHTTPQRCodeProvider 
@@ -15,7 +15,7 @@ class QRServerProvider extends BaseHTTPQRCodeProvider
     function __construct($verifyssl = false, $errorcorrectionlevel = 'L', $margin = 4, $qzone = 1, $bgcolor = 'ffffff', $color = '000000', $format = 'png') 
     {
         if (!is_bool($verifyssl))
-            throw new Exception('VerifySSL must be bool');
+            throw new QRException('VerifySSL must be bool');
 
         $this->verifyssl = $verifyssl;
         

RobThree/TwoFactorAuth/Providers/Qr/QRicketProvider.php

@@ -1,6 +1,6 @@
 <?php
 
-namespace RobThree\TwoFactorAuth\Providers;
+namespace RobThree\TwoFactorAuth\Providers\Qr;
 
 // http://qrickit.com/qrickit_apps/qrickit_api.php
 class QRicketProvider extends BaseHTTPQRCodeProvider 

RobThree/TwoFactorAuth/Providers/Rng/HashRNGProvider.php

@@ -0,0 +1,23 @@
+<?php
+namespace RobThree\TwoFactorAuth\Providers\Rng;
+
+class HashRNGProvider implements IRNGProvider
+{
+    private $algorithm;
+    
+    function __construct($algorithm = 'sha256' ) {
+        $algos = array_values(hash_algos());
+        if (!in_array($algorithm, $algos, true))
+            throw new RNGException('Unsupported algorithm specified');
+        $this->algorithm = $algorithm;
+    }
+    
+    public function getRandomBytes($bytecount) {
+        $result = array();
+        for ($i = 0; $i < $bytecount; $i++) {
+            $hash = hash($this->algorithm, $hash.mt_rand(), true);
+            array_push($result, $hash[mt_rand(0, sizeof($hash))]);
+        }
+        return $result;
+    }
+}

RobThree/TwoFactorAuth/Providers/Rng/IRNGProvider.php

@@ -0,0 +1,8 @@
+<?php
+
+namespace RobThree\TwoFactorAuth\Providers\Rng;
+
+interface IRNGProvider
+{
+    public function getRandomBytes($bytecount);
+}

RobThree/TwoFactorAuth/Providers/Rng/MCryptRNGProvider.php

@@ -0,0 +1,19 @@
+<?php
+
+namespace RobThree\TwoFactorAuth\Providers\Rng;
+
+class MCryptRNGProvider implements IRNGProvider
+{
+    private $source;
+    
+    function __construct($source = MCRYPT_DEV_URANDOM ) {
+        $this->source = $source;
+    }
+    
+    public function getRandomBytes($bytecount) {
+        $result = mcrypt_create_iv($bytecount, $this->source);
+        if ($result === false)
+            throw new RNGException('mcrypt_create_iv returned an invalid value');
+        return $result;
+    }
+}

RobThree/TwoFactorAuth/Providers/Rng/OpenSSLRNGProvider.php

@@ -0,0 +1,21 @@
+<?php
+
+namespace RobThree\TwoFactorAuth\Providers\Rng;
+
+class OpenSSLRNGProvider implements IRNGProvider
+{
+    private $requirestrong;
+    
+    function __construct($requirestrong = true) {
+        $this->requirestrong = $requirestrong;
+    }
+    
+    public function getRandomBytes($bytecount) {
+        $result = openssl_random_pseudo_bytes($bytecount, $crypto_strong);
+        if ($this->requirestrong && ($crypto_strong === false))
+            throw new RNGException('openssl_random_pseudo_bytes returned non-cryptographically strong value');
+        if ($result === false)
+            throw new RNGException('openssl_random_pseudo_bytes returned an invalid value');
+        return $result;
+    }
+}

RobThree/TwoFactorAuth/Providers/Rng/RNGException.php

@@ -0,0 +1,11 @@
+<?php
+
+namespace RobThree\TwoFactorAuth\Providers\Rng;
+
+class RNGException extends \Exception
+{
+    function __construct($message = "", $code = 0, $exception = null)
+    {
+    	parent::__construct($message, $code, $exception);
+    }
+}

RobThree/TwoFactorAuth/TwoFactorAuth.php

@@ -11,11 +11,12 @@ class TwoFactorAuth
     private $digits;
     private $issuer;
     private $qrcodeprovider;
+    private $rngprovider;
     private static $_base32;
     private static $_base32lookup = array();
     private static $_supportedalgos = array('sha1', 'sha256', 'sha512', 'md5');
     
-    function __construct($issuer = null, $digits = 6, $period = 30, $algorithm = 'sha1', $qrcodeprovider = null) 
+    function __construct($issuer = null, $digits = 6, $period = 30, $algorithm = 'sha1', $qrcodeprovider = null, $rngprovider = null) 
     {
         $this->issuer = $issuer;
 
@@ -32,14 +33,31 @@ class TwoFactorAuth
             throw new Exception('Unsupported algorithm: ' . $algorithm);
         $this->algorithm = $algorithm;
         
+        // Set default QR Code provider if none was specified
         if ($qrcodeprovider==null)
-            $qrcodeprovider = new Providers\GoogleQRCodeProvider();
+            $qrcodeprovider = new Providers\Qr\GoogleQRCodeProvider();
         
-        if (!($qrcodeprovider instanceof Providers\IQRCodeProvider))
+        if (!($qrcodeprovider instanceof Providers\Qr\IQRCodeProvider))
             throw new Exception('QRCodeProvider must implement IQRCodeProvider');
         
         $this->qrcodeprovider = $qrcodeprovider;
         
+        // Try to find best available RNG provider if none was specified
+        if ($rngprovider==null) {
+            if (function_exists('mcrypt_create_iv')) {
+                $rngprovider = new Providers\Rng\MCryptRNGProvider();
+            } elseif (function_exists('openssl_random_pseudo_bytes')) {
+                $rngprovider = new Providers\Rng\OpenSSLRNGProvider();
+            } else {
+                $rngprovider = new Providers\Rng\HashRNGProvider();
+            }
+        }
+        
+        if (!($rngprovider instanceof Providers\Rng\IRNGProvider))
+            throw new Exception('RNGProvider must implement IRNGProvider');
+        
+        $this->rngprovider = $rngprovider;
+        
         self::$_base32 = str_split('ABCDEFGHIJKLMNOPQRSTUVWXYZ234567=');
         self::$_base32lookup = array_flip(self::$_base32);
     }
@@ -51,7 +69,7 @@ class TwoFactorAuth
     {
         $secret = '';
         $bytes = ceil($bits / 5);   //We use 5 bits of each byte (since we have a 32-character 'alphabet' / BASE32)
-        $rnd = openssl_random_pseudo_bytes($bytes);
+        $rnd = $this->rngprovider->getRandomBytes($bytes);
         for ($i = 0; $i < $bytes; $i++)
             $secret .= self::$_base32[ord($rnd[$i]) & 31];  //Mask out left 3 bits for 0-31 values
         return $secret;

TwoFactorAuth.phpproj

@@ -24,11 +24,17 @@
   <ItemGroup>
     <Compile Include="demo.php" />
     <Compile Include="loader.php" />
-    <Compile Include="RobThree\TwoFactorAuth\Providers\BaseHTTPQRCodeProvider.php" />
-    <Compile Include="RobThree\TwoFactorAuth\Providers\GoogleQRCodeProvider.php" />
-    <Compile Include="RobThree\TwoFactorAuth\Providers\IQRCodeProvider.php" />
-    <Compile Include="RobThree\TwoFactorAuth\Providers\QRicketProvider.php" />
-    <Compile Include="RobThree\TwoFactorAuth\Providers\QRServerProvider.php" />
+    <Compile Include="RobThree\TwoFactorAuth\Providers\Qr\BaseHTTPQRCodeProvider.php" />
+    <Compile Include="RobThree\TwoFactorAuth\Providers\Qr\GoogleQRCodeProvider.php" />
+    <Compile Include="RobThree\TwoFactorAuth\Providers\Qr\IQRCodeProvider.php" />
+    <Compile Include="RobThree\TwoFactorAuth\Providers\Qr\QRException.php" />
+    <Compile Include="RobThree\TwoFactorAuth\Providers\Qr\QRicketProvider.php" />
+    <Compile Include="RobThree\TwoFactorAuth\Providers\Qr\QRServerProvider.php" />
+    <Compile Include="RobThree\TwoFactorAuth\Providers\Rng\IRNGProvider.php" />
+    <Compile Include="RobThree\TwoFactorAuth\Providers\Rng\MCryptRNGProvider.php" />
+    <Compile Include="RobThree\TwoFactorAuth\Providers\Rng\OpenSSLRNGProvider.php" />
+    <Compile Include="RobThree\TwoFactorAuth\Providers\Rng\HashRNGProvider.php" />
+    <Compile Include="RobThree\TwoFactorAuth\Providers\Rng\RNGException.php" />
     <Compile Include="RobThree\TwoFactorAuth\TwoFactorAuth.php" />
     <Compile Include=".gitignore" />
     <Compile Include="README.md" />
@@ -37,6 +43,8 @@
     <Folder Include="RobThree\" />
     <Folder Include="RobThree\TwoFactorAuth\" />
     <Folder Include="RobThree\TwoFactorAuth\Providers\" />
+    <Folder Include="RobThree\TwoFactorAuth\Providers\Rng\" />
+    <Folder Include="RobThree\TwoFactorAuth\Providers\Qr\" />
   </ItemGroup>
   <ItemGroup>
     <Content Include="LICENSE" />