SSH-RSA/SSH-DSA validation

ssh_key_validation.php

<?php

public function validateKey($value) 
{
  $key_parts = explode(' ', $value, 3);

  if (count($key_parts) < 2) {
    return false;
  }

  if (count($key_parts) > 3) {
    return false;
  }

  $algorithm = $key_parts[0];
  $key = $key_parts[1];

  if (!in_array($algorithm, array('ssh-rsa', 'ssh-dss'))) {
    return false;
  }
  $key_base64_decoded = base64_decode($key, true);

  if ($key_base64_decoded == FALSE) {
    return false;
  }

  $check = base64_decode(substr($key,0,16));
  $check = preg_replace("/[^\w\-]/","", $check); 

  if((string) $check !== (string) $algorithm) {
    return false;
  }
  return true;
}

This comes in handy. The only thing I had to change to really make it work is:

base64_decode($key);

instead of

base64_decode($key, true);

There is an vulnerability at

 if (count($key_parts) > 3) {

because explode(' ', $value, 3) will always result in count <= 3, so invalid key could pass.

Solution is to change explode(' ', $value, 3) to explode(' ', $value)