PHP download

Download the PHP package jnativel/sentinel-vault without Composer

On this page you can find all versions of the php package jnativel/sentinel-vault. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.

Table of contents
Download jnativel/sentinel-vault
More information about jnativel/sentinel-vault
Files in jnativel/sentinel-vault

Vendor jnativel
Package sentinel-vault
Short Description A lightweight, self-contained PHP Key Management System (KMS) using XChaCha20-Poly1305 AEAD encryption with per-user DEX keys.
License MIT

Keywords php security cryptography encryption vault kms aead Xchacha20 jnativel key-management

FAQ

After the download, you have to make one include require_once('vendor/autoload.php');. After that you have to import the classes with use statements.

Example:

If you use only one package a project is not needed. But if you use more then one package, without a project it is not possible to import the classes with use statements.

In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.

Some PHP packages are not free to download and because of that hosted in private repositories. In this case some credentials are needed to access such packages. Please use the auth.json textarea to insert credentials, if a package is coming from a private repository. You can look here for more information.

Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
To use Composer is sometimes complicated. Especially for beginners.
Composer needs much resources. Sometimes they are not available on a simple webspace.
If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.

Please rate this library. Is it a good library?

Example code of jnativel/sentinel-vault

Informations about the package sentinel-vault

SentinelVault — Secure Key Management and Encryption (KMS)

SentinelVault is a standalone PHP class providing a lightweight Key Management System (KMS).
It securely handles encryption, decryption, and user-specific Data Encryption Keys (DEX), all protected by a master key.

🔐 Features

XChaCha20-Poly1305 AEAD encryption (via PHP libsodium)
Master key encryption model (MASTER_KEY_B64)
Per-user Data Encryption Keys (DEX), each sealed with the master key
Associated Data (AD) support for contextual encryption
Status / Expiration / Metadata fields for key lifecycle management
Key rotation: re-encrypt DEX with a new master key
Rekeying: regenerate internal DEX keys while preserving metadata

🧩 Architecture Overview

DEX JSON structure (before encryption)

⚙️ Installation

Requirements

PHP 8.2+
ext-sodium enabled
No external dependencies

Usage

🕓 DEX Lifecycle Management

Metadata fields

Field	Type	Description
`status`	string	`ACTIVE`, `SUSPENDED`, or `REVOKED`
`exp`	string	ISO-8601 UTC expiration date
`meta`	object	Arbitrary metadata (tags, labels, etc.)

Access control

When using encryptWithDex() or decryptWithDex():

If status is SUSPENDED or REVOKED, operation fails.
If exp date is in the past, operation fails.

🔁 Master Key Rotation

Rotate all stored DEX blobs when the master key changes.

♻️ DEX Rekeying

Regenerate the internal user encryption key while keeping metadata intact.

🧪 DEX Metadata Access

You can safely read non-sensitive information from a DEX without exposing its internal key.

🧱 Security Design

The master key never leaves the environment (MASTER_KEY_B64 in .env or secret manager).
Each DEX is sealed using AEAD (XChaCha20-Poly1305) with unique associated data.
Each user data chunk is encrypted with its own per-DEX key, isolated from others.
AEAD ensures authentication: ciphertext tampering causes decryption to fail.
status and exp ensure fine-grained key control for suspension and expiration.

🧰 Advanced Operations

Method	Description
`createDexKey($dexAd, $userAD, $opts)`	Create a new DEX with optional metadata
`getDexMeta($dexBlob, $dexAd)`	Read DEX metadata without revealing the private key
`encryptWithDex($dexBlob, $dexAd, $plaintext)`	Encrypt data using a DEX
`decryptWithDex($dexBlob, $dexAd, $ciphertext)`	Decrypt data using a DEX
`rotateDexMasterKey($dexBlob, $currentDexAd, $newMasterKeyB64, $newDexAd = null)`	Re-encrypt DEX with a new master key
`rekeyDexUserKey($dexBlob, $dexAd)`	Regenerate internal DEX key

🧿 Example Workflow

System initialization
Create a user DEX
Encrypt user data
Rotate master key later

🧠 Design Principles

Simple, self-contained, no external dependencies.
One class = one KMS engine.
Secure by design: AEAD, zero-copy key handling, context binding via AD.
Extensible for multi-tenant or multi-service contexts.

🧭 Operational Separation & Service Model (Recommended)

For stronger security, run SentinelVault in an isolated environment, separate from your main application.

Why

Running the vault as an independent service ensures that even if your app is compromised, attackers cannot access the master key or decrypt sensitive data.
It also allows independent deployment, scaling, auditing, and key rotation.

How

Deploy SentinelVault as a dedicated container, host, or microservice.
Expose only a minimal internal API (private network or mTLS) to handle DEX creation and encryption/decryption.
Keep the master key outside your project files — use environment secrets, HSM, or a managed KMS.
The main app never stores or reads the master key; it only calls the API.

Example API endpoints

Summary

Separating SentinelVault from your main stack:

Prevents direct access to cryptographic materials
Reduces attack surface and lateral movement risk
Simplifies auditing, compliance, and recovery

📄 License

All versions of sentinel-vault with dependencies

PHP Build Version

Package Version

Version v0.1.3 Release 30. Oct 2025
create-project require 0 people chose require and
0 people chose create-project.

Download

Download latest version of sentinel-vault from vendor jnativel

Requires php Version ^8.2
ext-sodium Version *

Composer command for our command line client (download client) This client runs in each environment. You don't need a specific PHP version etc. The first 20 API calls are free. Standard composer command

The package jnativel/sentinel-vault contains the following files

Loading the files please wait ...