Download the PHP package dwgebler/encryption without Composer

PHP Encryption

A cryptography API wrapping the Sodium library, providing a simple object interface for symmetrical and asymmetrical encryption, decryption, digital signing and message authentication.

The Encryption class is able to generate secrets and keypairs, encrypt and decrypt data, sign and verify data, and generate and verify digital signatures.

Encrypted messages are returned base64 encoded, while keys and secrets are returned as hexadecimal strings.

The transformation of these to and from binary data makes use of the sodium_* timing-safe functions.

All underlying cryptography is performed using the Sodium library.

This library requires PHP 7.2 or higher with libsodium installed (this is bundled with PHP 7.2 or above, so you probably already have it).

Installation

Install via Composer

Usage

For a quick start, see the included demo.php file.

Create an instance of the Encryption class.

Symmetric Encryption

With a password

Use the function encryptWithPassword() to encrypt a message using a password. A secure key will be deterministically derived from the password using sodium_crypto_pwhash(). The returned encrypted data will be base64 encoded and include the randomly generated salt used to derive the key.

The corresponding decryptWithPassword() function will decrypt the message using the same password.

With a secret key

Use the function encryptWithSecret(string $message, string $key, bool $hexEncoded = true) to encrypt a message with a secret key. This function expects the message or data to be encrypted as a string, and the secret key as a hexadecimal string. If your secret is not a hexadecimal encoded, you can pass false as the third parameter to indicate that the secret is not encoded.

You can either generate a secret key with generateSecret() or use a pre-existing one.

Alternatively, you can pass in a reference to a null or empty string to generate a secret key.

To decrypt your message, use the function decryptWithSecret().

Asymmetric Encryption

To carry out authenticated asymmetric encryption (i.e. where the message is both encrypted and the sender of the message can be verified), you need to generate a public and private key pair for the sender. You will also need the public key of the recipient.

As an example, let's encrypt a message from Alice to Bob.

You can also use this library to carry out anonymous asymmetric encryption, using only the public key of the recipient. In this case, the sender's private key is not required and although only the recipient (the holder of the corresponding private key) can decode the message, they cannot identify or authenticate the sender. This is similar to openssl_public_encrypt.

Digital Signing

Asymmetric encryption is useful for securing messages, but it is also useful for authenticating the sender of a message.

Digital signatures are a way to authenticate the sender of a message, as well the message itself, ensuring it has not been tampered with or altered during transmission.

We can also generate a signature for a message without attaching it to the message itself.

Message Authentication

Instead of asymmetric keys, we can also use a shared secret to generate a Message Authentication Code (MAC) and use this to sign and authenticate messages.

Licence

This software is released under the MIT License.

Bugs, questions, comments

Please raise a GitHub issue if you encounter any problems or have any questions.