SecureMessage.php

<?php

include_once(APP_DIR . 'database/Database.php');
include_once(APP_DIR . 'config/config.php');
include_once(APP_DIR . 'model/User.php');

class SecureMessage {
    protected static $table = 'messages';

    public $id;
    public $message;
    public $sender_id;
    public $receiver_id;
    public $is_read = false;

    /**
     * Stores this information pertaining to this message in the DB
     */
    public function save() {
        $dbh = Database::connect();
        if (SecureMessage::exists($this->id)) {
            $stmt = $dbh->prepare("UPDATE messages SET is_read=:is_read WHERE id=:message_id");
            $is_read = (int) $this->is_read;
            $stmt->bindParam(':is_read', $is_read);
            $stmt->bindParam(':message_id', $this->id);
            $stmt->execute();
            return;
        }
        $integrity_key = openssl_random_pseudo_bytes(16);
        $encryption_key = openssl_random_pseudo_bytes(16);
        $message_iv = openssl_random_pseudo_bytes(openssl_cipher_iv_length(Config::encr_algo));

        $message_hash = hash_hmac(Config::hash_algo, $this->message, $integrity_key);
        $ciphertext = openssl_encrypt($this->message . $message_hash, Config::encr_algo, $encryption_key, 0, $message_iv);

        $keys_iv = openssl_random_pseudo_bytes(openssl_cipher_iv_length(Config::encr_algo));

        $enc_keys = openssl_encrypt($integrity_key . $encryption_key, Config::encr_algo, Config::secret_key, 0, $keys_iv);

        $stmt = $dbh->prepare('INSERT INTO messages (message, sender_id, receiver_id, enc_keys, keys_iv, message_iv)
                               VALUES (:message, :sender_id, :receiver_id, :enc_keys, :keys_iv, :message_iv)
        ');

        $encoded_keys_iv = base64_encode($keys_iv);
        $encoded_message_iv = base64_encode($message_iv);

        $stmt->bindParam(':message', $ciphertext);
        $stmt->bindParam(':sender_id', $this->sender_id);
        $stmt->bindParam(':receiver_id', $this->receiver_id);
        $stmt->bindParam(':enc_keys', $enc_keys);
        $stmt->bindParam(':keys_iv', $encoded_keys_iv);
        $stmt->bindParam(':message_iv', $encoded_message_iv);
        $stmt->execute();
        $this->id = $dbh->lastInsertId();
    }

    public function delete() {
        $dbh = Database::connect();
        $stmt = $dbh->prepare("DELETE FROM messages WHERE id=:id");
        $stmt->bindParam(':id', $this->id);
        $stmt->execute();
    }

    public static function exists($message_id) {
        $dbh = Database::connect();
        $stmt = $dbh->prepare("SELECT count(*) FROM messages WHERE id = :message_id");
        $stmt->bindParam(':message_id', $message_id);
        $stmt->execute();
        return $stmt->fetchColumn() > 0;
    }

    public static function getByID($message_id) {
        $messages = SecureMessage::all();
        foreach ($messages as $m) {
            if ($m->id == $message_id) {
                return $m;
            }
        }
        return null;
    }

    public static function all() {
        $dbh = Database::connect();
        $stmt = $dbh->prepare("SELECT * from messages");
        $stmt->execute();
        $messages = array_map(function ($row) {
            $m = new SecureMessage;
            $keys_iv = base64_decode($row['keys_iv']);
            $message_iv = base64_decode($row['message_iv']);

            /* Decrypt to get the keys */
            $keys = openssl_decrypt($row['enc_keys'], Config::encr_algo, Config::secret_key, 0, $keys_iv);

            $integrity_key = substr($keys, 0, strlen($keys) / 2);
            $message_key = substr($keys, strlen($keys) / 2);

            /* Decrypt and extract the message and hash */
            $decrypted = openssl_decrypt($row['message'], Config::encr_algo, $message_key, 0, $message_iv);
            $message = substr($decrypted, 0, strlen($decrypted) - 64);
            $message_hash = substr($decrypted, strlen($decrypted) - 64);

            /* Verify integrity of message */
            if (hash_hmac(Config::hash_algo, $message, $integrity_key) != $message_hash) {
                return null;
            }

            $m->id = $row['id'];
            $m->message = $message;
            $m->sender_id = $row['sender_id'];
            $m->receiver_id = $row['receiver_id'];
            $m->is_read = (bool) $row['is_read'];
            return $m;
        }, $stmt->fetchAll());

        /* Filter out bad messages */
        return array_filter($messages, function ($m) {
            return $m != null;
        });
    }

    public static function all_from($user_id) {
        $messages = SecureMessage::all();
        return array_filter($messages, function ($m) use ($user_id) {
            return $m->sender_id == $user_id;
        });
    }

    public static function all_to($user_id) {
        $messages = SecureMessage::all();
        return array_filter($messages, function ($m) use ($user_id) {
            return $m->receiver_id == $user_id;
        });
    }

    public static function all_for($user_id) {
        $messages = SecureMessage::all();
        return array_filter($messages, function ($m) use ($user_id) {
            return $m->sender_id == $user_id || $m->receiver_id = $user_id;
        });
    }

    public static function count_unread($user_id) {
        $messages = SecureMessage::all();
        return count(array_filter($messages, function ($m) use ($user_id) {
            return $m->receiver_id == $user_id && ! $m->is_read;
        }));
    }

    public function sender() {
        return User::getByID($this->sender_id);
    }

    public function receiver() {
        return User::getByID($this->receiver_id);
    }
}
?>