/**
  * Generates a new key pair with the given length in bits.
  *
  * @api
  * @param int $bits length of the key
  * @return KeyPair generated key pair
  */
 public function generate($bits = 2048)
 {
     if (!is_int($bits)) {
         throw new \InvalidArgumentException(sprintf("\$bits must be of type int, %s given", gettype($bits)));
     }
     if ($bits < 2048) {
         throw new \InvalidArgumentException("Keys with fewer than 2048 bits are not allowed!");
     }
     $configFile = $defaultConfigFile = __DIR__ . "/../res/openssl.cnf";
     if (class_exists("Phar") && !empty(Phar::running(true))) {
         $configContent = file_get_contents($configFile);
         $configFile = tempnam(sys_get_temp_dir(), "acme_openssl_");
         file_put_contents($configFile, $configContent);
         register_shutdown_function(function () use($configFile) {
             @unlink($configFile);
         });
     }
     $res = openssl_pkey_new(["private_key_type" => OPENSSL_KEYTYPE_RSA, "private_key_bits" => $bits, "config" => $configFile]);
     $success = openssl_pkey_export($res, $privateKey, null, ["config" => $configFile]);
     if ($configFile !== $defaultConfigFile) {
         @unlink($configFile);
     }
     if (!$success) {
         openssl_pkey_free($res);
         throw new \RuntimeException("Key export failed!");
     }
     $publicKey = openssl_pkey_get_details($res)["key"];
     openssl_pkey_free($res);
     // clear error buffer, because of minimalistic openssl.cnf
     while (openssl_error_string() !== false) {
     }
     return new KeyPair($privateKey, $publicKey);
 }

 /**
  * Generate public and private key
  * @param array $options
  */
 public function generateKeys(array $options = self::DEFAULT_PUBLIC_KEY_OPTIONS)
 {
     $keys = openssl_pkey_new($options);
     $this->publicKey = openssl_pkey_get_details($keys)["key"];
     openssl_pkey_export($keys, $this->privateKey);
     openssl_pkey_free($keys);
 }

 /**
  * Frees the resource associated with this private key.
  * This is automatically done on destruct.
  */
 private function free()
 {
     if ($this->keyResource) {
         openssl_pkey_free($this->keyResource);
     }
     $this->keyResource = null;
 }

function gal_service_account_upgrade(&$option, $gal_option_name, &$existing_sa_options, $gal_sa_option_name)
{
    /* Convert ga_serviceemail ga_keyfilepath
     * into new separate sa options:
     * ga_sakey, ga_serviceemail, ga_pkey_print
     */
    if (count($existing_sa_options)) {
        return;
    }
    $existing_sa_options = array('ga_serviceemail' => isset($option['ga_serviceemail']) ? $option['ga_serviceemail'] : '', 'ga_sakey' => '', 'ga_pkey_print' => '<unspecified>');
    try {
        if (version_compare(PHP_VERSION, '5.3.0') >= 0 && function_exists('openssl_x509_read')) {
            if (isset($option['ga_keyfilepath']) && $option['ga_keyfilepath'] != '' && file_exists($option['ga_keyfilepath'])) {
                $p12key = @file_get_contents($option['ga_keyfilepath']);
                $certs = array();
                if (openssl_pkcs12_read($p12key, $certs, 'notasecret')) {
                    if (array_key_exists("pkey", $certs) && $certs["pkey"]) {
                        $privateKey = openssl_pkey_get_private($certs['pkey']);
                        $pemString = '';
                        if (openssl_pkey_export($privateKey, $pemString)) {
                            $existing_sa_options['ga_sakey'] = $pemString;
                        }
                        openssl_pkey_free($privateKey);
                        @unlink($options['ga_keyfilepath']);
                    }
                }
            }
        }
    } catch (Exception $e) {
        // Never mind
    }
    // Remove redundant parts of regular options
    unset($option['ga_serviceemail']);
    unset($option['ga_keyfilepath']);
}

 function rsa_decrypt($ciphertext, $private_key, $password)
 {
     // 암호문을 base64로 디코딩한다.
     $ciphertext = @base64_decode($ciphertext, true);
     if ($ciphertext === false) {
         return false;
     }
     // 개인키를 사용하여 복호화한다.
     $privkey_decoded = @openssl_pkey_get_private($private_key, $password);
     if ($privkey_decoded === false) {
         return false;
     }
     $plaintext = false;
     $status = @openssl_private_decrypt($ciphertext, $plaintext, $privkey_decoded);
     @openssl_pkey_free($privkey_decoded);
     if (!$status || $plaintext === false) {
         return false;
     }
     // 압축을 해제하여 평문을 얻는다.
     $plaintext = @gzuncompress($plaintext);
     if ($plaintext === false) {
         return false;
     }
     // 이상이 없는 경우 평문을 반환한다.
     return $plaintext;
 }

 public function __destruct()
 {
     if (!is_resource($this->handle)) {
         return;
     }
     openssl_pkey_free($this->handle);
 }

 public function removeAll()
 {
     foreach ($this->resources as $resource) {
         openssl_pkey_free($resource);
     }
     $this->keys = array();
     $this->resources = array();
 }

 /**
  * Generate a key pair (public / private key) with optional passphrase
  * that protects the private key.
  *
  * @param string $passphrase
  * @return KeyPair
  */
 public function generateKeyPair($passphrase = null)
 {
     $privateKey = null;
     $encrypted = $passphrase !== null;
     $keyPair = openssl_pkey_new();
     openssl_pkey_export($keyPair, $privateKey, $passphrase);
     $keyDetails = openssl_pkey_get_details($keyPair);
     $publicKey = $keyDetails['key'];
     openssl_pkey_free($keyPair);
     return new KeyPair($privateKey, $publicKey, $encrypted);
 }

 /**
  * Generate a key pair (public / private key) with optional passphrase
  * that protects the private key.
  *
  * @param string $passphrase
  * @return \TYPO3\Deploy\Encryption\KeyPair
  * @author Christopher Hlubek <[email protected]>
  */
 public function generateKeyPair($passphrase = NULL)
 {
     $privateKey = NULL;
     $encrypted = $passphrase !== NULL;
     $keyPair = openssl_pkey_new();
     openssl_pkey_export($keyPair, $privateKey, $passphrase);
     $keyDetails = openssl_pkey_get_details($keyPair);
     $publicKey = $keyDetails['key'];
     openssl_pkey_free($keyPair);
     return new \TYPO3\Deploy\Encryption\KeyPair($privateKey, $publicKey, $encrypted);
 }

 /**
  * @param Signature $signature
  *
  * @return boolean Whether the signature has been signed by this certificate
  */
 public function hasSigned(Signature $signature)
 {
     $key = openssl_pkey_get_public($this->x509Cert);
     try {
         $hasSigned = $signature->isSignedByKey($key);
     } catch (\Excetpion $e) {
         openssl_pkey_free($key);
         throw $e;
     }
     openssl_pkey_free($key);
     return $hasSigned;
 }

 /**
  * Sign a string using the configured private key
  *
  * @param string $str  The string to calculate a signature for
  */
 private function base64_signature($str)
 {
     $key = openssl_pkey_get_private($this->private_key);
     if ($key === false) {
         throw new SimpleSAML_Error_Exception("Unable to load private key: " . openssl_error_string());
     }
     if (!openssl_sign($str, $sig, $key)) {
         throw new SimpleSAML_Error_Exception("Unable to create signature: " . openssl_error_string());
     }
     openssl_pkey_free($key);
     return base64_encode($sig);
 }

 protected function load()
 {
     if (false == is_file($this->filename)) {
         throw new \RuntimeException(sprintf("Specified private key file '%s' does not exist", $this->filename));
     }
     $this->loadedContent = file_get_contents($this->filename);
     $resource = openssl_pkey_get_private($this->loadedContent);
     if (false == $resource) {
         $this->loadedContent = null;
         throw new \RuntimeException(sprintf("Specified private key '%s' is invalid", $this->filename));
     }
     openssl_pkey_free($resource);
 }

 /**
  * Function to generate a new RSA keypair. This is not
  * used for point derivation or for generating signatures.
  * Only used for assymetric data encryption, as needed.
  *
  * @param int
  * @param string
  * @return array|boolean array of keys on success, boolean false on failure
  */
 public final function generateKeypair($keybits = 512, $digest_alg = 'sha512')
 {
     try {
         /* see: http://www.php.net/manual/en/function.openssl-pkey-new.php */
         if (function_exists('openssl_pkey_new')) {
             $keypair = array();
             /* openssl keysize can't be smaller than 384 bits */
             if ((int) $keybits < 384) {
                 $keybits = 384;
             }
             if (!isset($digest_alg) || trim($digest_alg) == '') {
                 $digest_alg = 'sha512';
             }
             /*
              * RSA is the only supported key type at this time
              * http://www.php.net/manual/en/function.openssl-csr-new.php
              */
             $config = array('digest_alg' => $digest_alg, 'private_key_bits' => (int) $keybits, 'private_key_type' => OPENSSL_KEYTYPE_RSA);
             $resource = openssl_pkey_new($config);
             if (!$resource) {
                 throw new \Exception('Error in generateOpenSSLKeypair: Could not create new OpenSSL resource.');
                 /* with the openssl extension, you also have it's own errors returned */
                 while ($msg = openssl_error_string()) {
                     throw new \Exception('Error in generateOpenSSLKeypair: OpenSSL reported error: ' . $msg);
                 }
                 return false;
             }
             if (openssl_pkey_export($resource, $keypair['pri'])) {
                 $publickey = openssl_pkey_get_details($resource);
                 $keypair['pub'] = $publickey['key'];
             } else {
                 throw new \Exception('Error in generateOpenSSLKeypair: Private key could not be determined from OpenSSL key resource.');
                 while ($msg = openssl_error_string()) {
                     throw new \Exception('Error in generateOpenSSLKeypair: OpenSSL reported error: ' . $msg);
                 }
                 return false;
             }
             openssl_pkey_free($resource);
             return $keypair;
         } else {
             throw new \Exception('Error in generateOpenSSLKeypair: OpenSSL PHP extension missing. Cannot continue.');
             return false;
         }
     } catch (Exception $e) {
         while ($msg = openssl_error_string()) {
             throw new \Exception('Error in generateOpenSSLKeypair: OpenSSL reported error: ' . $msg);
         }
         throw $e;
         return false;
     }
 }

 /**
  * Returns a usable private and public key from a PEM encoded string.
  *
  * @param string $key  The private key.
  * @param string $pass The private key passphrase.
  *
  * @return array The private ([0]) and public ([1]) key.
  *
  * @throws InvalidArgumentException If a passphrase is required.
  * @throws RuntimeException         If the file could not be parsed.
  */
 public function parsePem($key, $pass = null)
 {
     $this->clearErrors();
     if (false === ($resource = openssl_pkey_get_private($key, $pass))) {
         $error = openssl_error_string();
         if (preg_match('/(bad password|bad decrypt)/', $error)) {
             throw new InvalidArgumentException('The private key passphrase is invalid.');
         }
         throw new RuntimeException("The private key could not be parsed: {$error}");
     }
     openssl_pkey_export($resource, $private);
     $details = openssl_pkey_get_details($resource);
     openssl_pkey_free($resource);
     return array($private, $details['key']);
 }

 public function onPasswordChange(FormEvent $event)
 {
     // Get new password
     /** @var User $user */
     $user = $event->getForm()->getData();
     $password = $user->getPlainPassword();
     // Get pkey from session
     $privKey = $event->getRequest()->getSession()->get('pkey');
     // Secure pkey with new password
     $res = openssl_pkey_get_private($privKey);
     openssl_pkey_export($res, $privKey, $password);
     // Store pkey in user
     $user->setPrivateKey($privKey);
     unset($password);
     openssl_pkey_free($res);
     unset($privKey);
 }

/**
 * Check if signature is correct
 * @param string SSH formatted public key
 * @param string
 * @param string
 * @return bool
 */
function verify($key, $data, $signature)
{
    if (($pkeyid = @openssl_pkey_get_public(ssh2pem($key))) === FALSE) {
        throw new Error('Cannot get public key.');
    }
    $details = openssl_pkey_get_details($pkeyid);
    list($keytype, $blob) = parse('ss', $signature);
    if ($details['type'] === OPENSSL_KEYTYPE_DSA && $keytype !== 'ssh-dss' || $details['type'] === OPENSSL_KEYTYPE_RSA && $keytype !== 'ssh-rsa') {
        throw new Error('Key/signature type mismatch.');
    }
    if ($keytype !== 'ssh-rsa') {
        throw new Error('FIXME: currently only ssh-rsa implemented');
    }
    $verified = @openssl_verify($data, $blob, $pkeyid);
    openssl_pkey_free($pkeyid);
    return $verified === 1;
}

/**
 * Post install hook implementation for the quizaccess_offlinemode plugin.
 */
function xmldb_quizaccess_offlinemode_install()
{
    global $OUTPUT;
    // If OpenSSL is available, generate a public/private key pair.
    if (function_exists('openssl_pkey_new')) {
        $privatekey = openssl_pkey_new(array('digest_alg' => 'sha512', 'private_key_bits' => 1024, 'private_key_type' => OPENSSL_KEYTYPE_RSA));
        if ($privatekey) {
            openssl_pkey_export($privatekey, $privatekeystring);
            $publickeydata = openssl_pkey_get_details($privatekey);
            openssl_pkey_free($privatekey);
            set_config('privatekey', $privatekeystring, 'quizaccess_offlinemode');
            set_config('publickey', $publickeydata['key'], 'quizaccess_offlinemode');
        } else {
            echo $OUTPUT->notification('Failed to generate an public/private key pair.');
            while ($message = openssl_error_string()) {
                echo $OUTPUT->notification($message);
            }
        }
    }
}

 public function testKeyGen()
 {
     $fileName = 'testfile_ssl_id_rsa_' . date('Ymd_His') . '_' . uniqid('', true);
     $sslConfig = array('digest_alg' => 'sha512', 'private_key_bits' => 4096, 'private_key_type' => OPENSSL_KEYTYPE_RSA);
     $ssl = openssl_pkey_new($sslConfig);
     $this->assertTrue($ssl ? true : false);
     openssl_pkey_export_to_file($ssl, 'test_data/' . $fileName . '.prv');
     #fwrite(STDOUT, 'SSL ERROR: '.openssl_error_string()."\n");
     openssl_pkey_export_to_file($ssl, 'test_data/' . $fileName . '_pass.prv', 'my_password');
     #fwrite(STDOUT, 'SSL ERROR: '.openssl_error_string()."\n");
     $keyPub = openssl_pkey_get_details($ssl);
     #ve($keyPub);
     $keyPub = $keyPub['key'];
     file_put_contents('test_data/' . $fileName . '.pub', $keyPub);
     openssl_public_encrypt('test my keys', $encrypted, $keyPub);
     #fwrite(STDOUT, 'SSL ERROR: '.openssl_error_string()."\n");
     openssl_private_decrypt($encrypted, $decrypted, $ssl);
     #fwrite(STDOUT, 'SSL ERROR: '.openssl_error_string()."\n");
     $this->assertEquals('test my keys', $decrypted);
     openssl_pkey_free($ssl);
 }

/**
 * Generate public/private keys and store in the config table
 *
 * Use the distinguished name provided to create a CSR, and then sign that CSR
 * with the same credentials. Store the keypair you create in the config table.
 * If a distinguished name is not provided, create one using the fullname of
 * 'the course with ID 1' as your organization name, and your hostname (as
 * detailed in $CFG->wwwroot).
 *
 * @param   array  $dn  The distinguished name of the server
 * @return  string      The signature over that text
 */
function mnet_generate_keypair($dn = null, $days = 28)
{
    global $CFG, $USER;
    // check if lifetime has been overriden
    if (!empty($CFG->mnetkeylifetime)) {
        $days = $CFG->mnetkeylifetime;
    }
    $host = strtolower($CFG->wwwroot);
    $host = ereg_replace("^http(s)?://", '', $host);
    $break = strpos($host . '/', '/');
    $host = substr($host, 0, $break);
    if ($result = get_record_select('course', " id ='" . SITEID . "' ")) {
        $organization = $result->fullname;
    } else {
        $organization = 'None';
    }
    $keypair = array();
    $country = 'NZ';
    $province = 'Wellington';
    $locality = 'Wellington';
    $email = $CFG->noreplyaddress;
    if (!empty($USER->country)) {
        $country = $USER->country;
    }
    if (!empty($USER->city)) {
        $province = $USER->city;
        $locality = $USER->city;
    }
    if (!empty($USER->email)) {
        $email = $USER->email;
    }
    if (is_null($dn)) {
        $dn = array("countryName" => $country, "stateOrProvinceName" => $province, "localityName" => $locality, "organizationName" => $organization, "organizationalUnitName" => 'Moodle', "commonName" => $CFG->wwwroot, "emailAddress" => $email);
    }
    $dnlimits = array('countryName' => 2, 'stateOrProvinceName' => 128, 'localityName' => 128, 'organizationName' => 64, 'organizationalUnitName' => 64, 'commonName' => 64, 'emailAddress' => 128);
    foreach ($dnlimits as $key => $length) {
        $dn[$key] = substr($dn[$key], 0, $length);
    }
    // ensure we remove trailing slashes
    $dn["commonName"] = preg_replace(':/$:', '', $dn["commonName"]);
    if (!empty($CFG->opensslcnf)) {
        //allow specification of openssl.cnf especially for Windows installs
        $new_key = openssl_pkey_new(array("config" => $CFG->opensslcnf));
        $csr_rsc = openssl_csr_new($dn, $new_key, array("config" => $CFG->opensslcnf));
        $selfSignedCert = openssl_csr_sign($csr_rsc, null, $new_key, $days, array("config" => $CFG->opensslcnf));
    } else {
        $new_key = openssl_pkey_new();
        $csr_rsc = openssl_csr_new($dn, $new_key, array('private_key_bits', 2048));
        $selfSignedCert = openssl_csr_sign($csr_rsc, null, $new_key, $days);
    }
    unset($csr_rsc);
    // Free up the resource
    // We export our self-signed certificate to a string.
    openssl_x509_export($selfSignedCert, $keypair['certificate']);
    openssl_x509_free($selfSignedCert);
    // Export your public/private key pair as a PEM encoded string. You
    // can protect it with an optional passphrase if you wish.
    if (!empty($CFG->opensslcnf)) {
        //allow specification of openssl.cnf especially for Windows installs
        $export = openssl_pkey_export($new_key, $keypair['keypair_PEM'], null, array("config" => $CFG->opensslcnf));
    } else {
        $export = openssl_pkey_export($new_key, $keypair['keypair_PEM']);
    }
    openssl_pkey_free($new_key);
    unset($new_key);
    // Free up the resource
    return $keypair;
}

 /**
  * Generate a DKIM signature.
  * @access public
  * @param string $signHeader
  * @throws phpmailerException
  * @return string The DKIM signature value
  */
 public function DKIM_Sign($signHeader)
 {
     if (!defined('PKCS7_TEXT')) {
         if ($this->exceptions) {
             throw new phpmailerException($this->lang('extension_missing') . 'openssl');
         }
         return '';
     }
     $privKeyStr = file_get_contents($this->DKIM_private);
     if ('' != $this->DKIM_passphrase) {
         $privKey = openssl_pkey_get_private($privKeyStr, $this->DKIM_passphrase);
     } else {
         $privKey = openssl_pkey_get_private($privKeyStr);
     }
     //Workaround for missing digest algorithms in old PHP & OpenSSL versions
     //@link http://stackoverflow.com/a/11117338/333340
     if (version_compare(PHP_VERSION, '5.3.0') >= 0 and in_array('sha256WithRSAEncryption', openssl_get_md_methods(true))) {
         if (openssl_sign($signHeader, $signature, $privKey, 'sha256WithRSAEncryption')) {
             openssl_pkey_free($privKey);
             return base64_encode($signature);
         }
     } else {
         $pinfo = openssl_pkey_get_details($privKey);
         $hash = hash('sha256', $signHeader);
         //'Magic' constant for SHA256 from RFC3447
         //@link https://tools.ietf.org/html/rfc3447#page-43
         $t = '3031300d060960864801650304020105000420' . $hash;
         $pslen = $pinfo['bits'] / 8 - (strlen($t) / 2 + 3);
         $eb = pack('H*', '0001' . str_repeat('FF', $pslen) . '00' . $t);
         if (openssl_private_encrypt($eb, $signature, $privKey, OPENSSL_NO_PADDING)) {
             openssl_pkey_free($privKey);
             return base64_encode($signature);
         }
     }
     openssl_pkey_free($privKey);
     return '';
 }