Download the PHP package azaharizaman/nexus-crypto without Composer
On this page you can find all versions of the php package azaharizaman/nexus-crypto. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Download azaharizaman/nexus-crypto
More information about azaharizaman/nexus-crypto
Files in azaharizaman/nexus-crypto
Package nexus-crypto
Short Description Framework-agnostic cryptographic abstraction layer with post-quantum readiness for ERP system
License MIT
Informations about the package nexus-crypto
Nexus\Crypto
Framework-agnostic cryptographic abstraction layer providing algorithm agility and post-quantum readiness for the Nexus ERP ecosystem.
Overview
The Nexus\Crypto package provides a complete cryptographic primitive library designed for long-term security and future-proofing against quantum computing threats. By abstracting all cryptographic operations behind interfaces, the package enables seamless migration from classical algorithms (RSA, ECDSA, AES) to post-quantum alternatives (Dilithium, Kyber) simply by changing bindings in the application layer.
Core Principles
- Algorithm Agility: All crypto operations via interfaces, enabling algorithm swapping without code changes
- Post-Quantum Readiness: Hybrid mode support planned for dual classical + PQC signing/encryption
- Stateless Design: All persistence via
KeyStorageInterface- no framework dependencies - Immutable Value Objects: All cryptographic results as readonly data structures
- Audit Trail: All operations compatible with
Nexus\AuditLoggerfor compliance
Features
Phase 1 (Current - Classical Algorithms)
- Hashing: SHA-256/384/512, BLAKE2b via Sodium
- Symmetric Encryption: AES-256-GCM (authenticated), ChaCha20-Poly1305
- Asymmetric Signing: Ed25519, RSA-2048/4096, ECDSA P-256, HMAC-SHA256
- Key Management: Envelope encryption, automated rotation via Scheduler
- Feature Flags: Gradual rollout support with
CRYPTO_LEGACY_MODE
Phase 2 (Planned - Hybrid PQC)
- Hybrid Signing: Dual ECDSA + Dilithium signatures
- Hybrid KEM: Dual X25519 + Kyber key encapsulation
- Transparent Migration: Existing code works unchanged
Phase 3 (Future - Pure PQC)
- Pure PQC Algorithms: ML-DSA, ML-KEM (NIST standards)
- Classical Deprecation: Full quantum-resistant operation
Installation
Required PHP Extensions
- ext-sodium: Required for modern algorithms (ChaCha20, Ed25519, BLAKE2b)
- ext-openssl: Required for legacy algorithms (RSA, AES-CBC)
Integration Requirements
Consuming applications must implement:
KeyStorageInterface- For persistent key storage- Service Container Bindings - Bind all crypto interfaces
- Master Key Management - Secure master key for envelope encryption
- (Optional) Scheduler Integration - For automated key rotation
Architecture
Usage
1. Hash Data (Integrity Checking)
2. Encrypt Data (Symmetric Encryption)
3. Sign Data (Digital Signatures)
4. HMAC Signing (Webhook Verification)
5. Key Rotation (Automated via Scheduler)
Value Objects
HashResult
EncryptedData
SignedData
KeyPair
EncryptionKey
Enums
HashAlgorithm
SymmetricAlgorithm
AsymmetricAlgorithm
Security Considerations
Envelope Encryption
All data encryption keys (DEKs) are encrypted with the master key (APP_KEY) before storage:
Key Rotation
- Automated:
KeyRotationHandlerruns daily viaNexus\Scheduler - Frequency: 90-day default (configurable)
- Audit Trail: All rotations logged to
key_rotation_history - Zero Downtime: Old keys retained for decryption of existing data
Algorithm Selection
Error Handling
Performance
Benchmarks (Phase 1 - Classical Algorithms)
| Operation | Algorithm | Input Size | Target | Actual |
|---|---|---|---|---|
| Hash | SHA-256 | 1 KB | < 1ms | ~0.3ms |
| Hash | BLAKE2b | 1 KB | < 1ms | ~0.2ms |
| Encrypt | AES-256-GCM | 1 KB | < 2ms | ~0.8ms |
| Decrypt | AES-256-GCM | 1 KB | < 2ms | ~0.9ms |
| Sign | Ed25519 | 1 KB | < 5ms | ~1.2ms |
| Verify | Ed25519 | 1 KB | < 5ms | ~1.5ms |
Benchmarks on PHP 8.3, ext-sodium 2.0.23
Roadmap
✅ Phase 1: Classical Algorithms (Q4 2025)
- [x] Core interfaces and value objects
- [x] Sodium-based implementations
- [x] Key rotation handler
- [x] Feature flag support
- [x] Legacy code refactoring
🔄 Phase 2: Hybrid PQC Mode (Q3 2026)
- [ ] Monitor liboqs-php maturity
- [ ] Implement
HybridSignerInterface - [ ] Implement
HybridKEMInterface - [ ] Dual signature verification
- [ ] Migration tooling
🔮 Phase 3: Pure PQC (Post-2027)
- [ ] NIST ML-DSA/ML-KEM standards finalized
- [ ] Pure PQC implementations
- [ ] Classical algorithm deprecation
- [ ] Performance optimization
Contributing
This package follows the Nexus architecture principles:
- Framework-agnostic: No Laravel dependencies in
src/ - Contract-driven: All persistence via interfaces
- Immutable: Readonly value objects only
- Testable: All dependencies injected
Documentation
User Documentation
- Getting Started - Quick start guide with prerequisites, core concepts, and first integration
- API Reference - Complete documentation of all interfaces, services, value objects, enums, and exceptions
- Integration Guide - Laravel and Symfony integration with complete examples
- Basic Usage Examples - Common cryptographic operations
- Advanced Usage Examples - Key rotation, envelope encryption, multi-tenant patterns
Project Documentation
- IMPLEMENTATION_SUMMARY.md - Development progress, metrics, and design decisions
- REQUIREMENTS.md - Complete requirements tracking (42 requirements, 88.1% complete)
- TEST_SUITE_SUMMARY.md - Testing strategy and recommendations (85 tests at application layer)
- VALUATION_MATRIX.md - Package valuation metrics ($225K estimated value, 1,719% ROI)
License
MIT License - see LICENSE file for details.
Security Disclosure
For security vulnerabilities, please email: [email protected] (DO NOT file public issues)