mbaynton / cms-autoupdate-design Goto Github PK

Don't use HMAC here. Instead, use in order of preference:

1. Ed25519 (via ext/libsodium)
2. Deterministic ECDSA over seck1p256
3. RSA (via phpseclib) with PSS padding, never PKCS1 padding

The reason is simple: HMAC is a symmetric key message authenticity verification that, in order to verify, you must be able to generate signatures. If the Drupal installation can verify the HMAC, it must have the HMAC key. What prevents an attacker from obtaining the key and using it to forge an update containing a trojan?

It's the wrong tool for the job. (See this primer on core cryptography concepts for an in-depth explanation on which tools work for the job.)

In Drupal's case, you really can't depend on libsodium yet (because of the current installed userbase) but you certainly use phpseclib to solve the problem.

You can also use RSA/ECDSA keys to sign a Phar directly. We do this for random_compat.