* Update Psalm

* Ignore DocblockTypeContradiction and RedundantConditionGivenDocblockType

* Fix Psalm-errors

* Raise minimum PHP-version to 5.6

* Update lock-file accordingly

* Fix phpunit

* Suppress Psalm-issue

This reverts commit 9ad60fe1.

Psalm is starting to get annoying. Both openssl_decrypt() and realpath() can return a string or false on error. Psalm seems to ignore the latter all of a sudden, so it assumes the returned variable will always be a string and then it fails when you check on errors. This fix explicitly declares the problematic variables with types string or false, so that psalm stops complaining.

This also required adding an additional argument to
SimpleSAML\Utils\Crypto::loadPrivateKey to ease in testing. Without
this additional argument, SimpleSAML_Configuration::getBaseDir eventually
gets called to determine the private key location.  This doesn't work
well with vfsstream. This argument shouldn't cause too much trouble, and
seems cohesive enough with the function's purpose.

The reason was the lack of conversion to integer for each character of the strings before applying the XOR operator to them. The operator returns always an empty string when applied to two characters, and applying a binary-wise OR between 0 and an empty string, yields 0. Therefore, $diff is always 0, and the function returns true for every two strings with same length, regardless of their contents.

This reverts commit b1b0d0ef.

This reverts commit c441f9c9.

It looks like mb_substr() doesn’t cope well with NULL as the third parameter in PHP 5.3.

IVs must be random and one-time (never reused). Additionally, by deriving it from the key, the key length was effectively reduced to 128 bits.

Use it when constant-time comparisons are needed to avoid side-channel attacks.

This resolves #476.

Issue a notice when the option is used nonetheless.

Closes: #432

Reimplement \SimpleSAML\Utils\Crypto::aesDecrypt() and \SimpleSAML\Utils\Crypto::aesEncrypt() to use openssl instead of mcrypt. This removes the direct dependency on mcrypt and closes #228.

Move the aes[En|De]crypt() functionality in \SimpleSAML\Utils\Crypto to internal methods where the secret is passed as a parameter. Then we don't need a working configuration to test the functionality.

Use InvalidArgumentException instead of SimpleSAML_Error_Exception when dealing with wrong input parameters.

Move SimpleSAML_Utilities::resolveCert() to SimpleSAML\Utils\Config::getCertPath() and deprecate the former.