Open Source PHP Software

1. sodium_compat

$alice_kp = sodium_crypto_sign_keypair();
$alice_sk = sodium_crypto_sign_secretkey($alice_kp);
$alice_pk = sodium_crypto_sign_publickey($alice_kp);

$message = 'This is a test message.';
$signature = sodium_crypto_sign_detached($message, $alice_sk);
if (sodium_crypto_sign_verify_detached($signature, $message, $alice_pk)) {
    echo 'OK', PHP_EOL;
} else {
    throw new Exception('Invalid signature');
}

2. Halite

<?php
use ParagonIE\Halite\KeyFactory;

$encKey = KeyFactory::generateEncryptionKey();
KeyFactory::save($encKey, '/path/outside/webroot/encryption.key');

<?php
use ParagonIE\Halite\KeyFactory;
use ParagonIE\Halite\Symmetric\Crypto as Symmetric;
use ParagonIE\HiddenString\HiddenString;

$encryptionKey = KeyFactory::loadEncryptionKey('/path/outside/webroot/encryption.key');

$message = new HiddenString('This is a confidential message for your eyes only.');
$ciphertext = Symmetric::encrypt($message, $encryptionKey);

$decrypted = Symmetric::decrypt($ciphertext, $encryptionKey);

var_dump($decrypted->getString() === $message->getString()); 

3. EasyDB

/* You cannot get SQL injection here */
$db->insert('table_name', [
    'example' => $_GET['foo']
]);

/* Placeholders become intuitive: */
foreach ($db->run("SELECT * FROM foo WHERE bar = ?", $_GET['bar']) as $row) {
    var_dump($row);
}

$statement = EasyStatement::open()
    ->with('last_login IS NOT NULL');

if (str_contains($_POST['search'], '@')) {
    // Perform a username search
    $statement->orWith('username LIKE ?', '%' . $db->escapeLikeValue($_POST['search']) . '%');
} else {
    // Perform an email search
    $statement->orWith('email = ?', $_POST['search']);
}

// The statement can compile itself to a string with placeholders:
echo $statement; /* last_login IS NOT NULL OR username LIKE ? */

// All the values passed to the statement are captured and can be used for querying:
$user = $db->single("SELECT * FROM users WHERE $statement", $statement->values());

$db->insert('table_name', [
    'foo' => $_GET['bar'],
    'timestamp' => new EasyPlaceholder('NOW()'),
    'expired' => new EasyPlaceholder('TIMESTAMPADD(HOUR, 2, NOW())'),
    'location' => new EasyPlaceholder(
            "ST_GeomFromText(CONCAT('POINT(', ?, ' ', ?, ')'))",
            $_GET['latitude'],
            $_GET['longitude']
        ),
    'sql_injection' => false
]);

4. Chronicle

5. Certainty

<?php
use ParagonIE\Certainty\RemoteFetch;

$fetcher = new RemoteFetch('/path/to/certainty/data');
$latestCACertBundle = $fetcher->getLatestBundle();

$ch = curl_init();
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, true);
curl_setopt($ch, CURLOPT_CAINFO, $latestCACertBundle->getFilePath());

6. CSP-Builder

{
    "report-only": false,
    "report-uri": "/csp_violation",
    "report-to": "csp",
    "base-uri": {
        "self": true
    },
    "default-src": {
        "self": true
    },
    "child-src": {
        "allow": [
            "https://www.youtube.com",
            "https://www.youtube-nocookie.com"
        ],
        "self": false
    },
    "connect-src": {
        "self": true
    },
    "font-src": {
        "self": true
    },
    "form-action": {
        "allow": [
            "https://example.com"
        ],
        "self": true
    },
    "frame-ancestors": [],
    "img-src": {
        "allow": [
            "https://ytimg.com"
        ],
        "self": true,
        "data": true
    },
    "media-src": [],
    "object-src": [],
    "plugin-types": [],
    "script-src": {
        "allow": [
            "https://ajax.googleapis.com",
            "https://cdn.mathjax.org",
            "https://oss.maxcdn.com",
            "https://www.google-analytics.com"
        ],
        "hashes": [
            {
                "sha256": "qznLcsROx4GACP2dm0UCKCzCG-HiZ1guq6ZZDob/Tng="
            }
        ],
        "self": true,
        "unsafe-inline": false,
        "unsafe-eval": false
    },
    "style-src": {
        "self": true
    },
    "upgrade-insecure-requests": true
}

7. Sapient

8. Corner

9. Ionizer

<?php
use ParagonIE\Ionizer\GeneralFilterContainer;
use ParagonIE\Ionizer\InputFilter;
use ParagonIE\Ionizer\Filter\{
    AllowList,
    BoolFilter,
    IntArrayFilter,
    IntFilter,
    StringFilter
};

// Define properties to filter:
$ic = new GeneralFilterContainer();
$ic->addFilter(
        'username',
        (new StringFilter())->setPattern('^[A-Za-z0-9_\-]{3,24}$')
    )
    ->addFilter(
        'passphrase',
        (new StringFilter())
    )
    ->addFilter(
        'dob.day',
         (new IntFilter())
             ->setMinimumValue(1)
             ->setMaximumValue(31)
    )
    ->addFilter(
        'dob.month',
         (new IntFilter())
             ->setMinimumValue(1)
             ->setMaximumValue(12)
    )
    ->addFilter(
        'dob.year',
         (new IntFilter())
             ->setMinimumValue(1900)
             ->setMaximumValue((int) date('Y'))
    )
    ->addFilter(
        'domain',
        new AllowList('US-1', 'US-2', 'EU-1', 'EU-2')
    )
    ->addFilter('accept-terms', new BoolFilter())
    ->addFilter('subscriptions', new IntArrayFilter());

// Invoke the filter container on the array to get the filtered result:
try {
    // $post passed all of our filters.
    $post = $ic($_POST);
} catch (\TypeError $ex) {
    // Invalid data provided.
}

- /myscript.php?foo=bar
+ /myscript.php?foo[]=bar

10. Easy-ECC

<?php
use ParagonIE\EasyECC\EasyECC;

// Generate an instance; defaults to Curve25519
$ecc = new EasyECC();

// Get a keypair
$alice_sk = $ecc->generatePrivateKey();
$alice_pk = $alice_sk->getPublicKey();

// Signing a message (with PEM-formatted signatures):
$message = 'This is extremely simple to use correctly.';
$signature = $ecc->sign($message, $alice_sk);

if (!$ecc->verify($message, $alice_pk, $signature)) {
    throw new Exception('Signature validation failed');
}

// Let's do a key exchange:
$bob_sk = $ecc->generatePrivateKey();
$bob_pk = $alice_sk->getPublicKey();

$alice_to_bob = $ecc->keyExchange($alice_sk, $bob_pk, true);
$bob_to_alice = $ecc->keyExchange($bob_sk, $alice_pk, false);

<php
use ParagonIE\EasyECC\EasyECC;
use ParagonIE\EasyECC\Integration\Defuse;
use Mdanter\Ecc\Crypto\Key\{
    PublicKeyInterface,
    PrivateKeyInterface
};

/**
 * @var EasyECC $ecc
 * @var PrivateKeyInterface $secretKey
 * @var PublicKeyInterface $publicKey
 */

// Let's load the integration (inject your EasyECC instance):
$defuse = new Defuse($ecc);

// You can seal/unseal messages (anonymous public-key encryption):
$superSecret = 'This is a secret message';
$sealed = $defuse->seal($superSecret, $publicKey);
$opened = $defuse->unseal($sealed, $secretKey);

Contributions and Alternatives to Internet Standards

1. PASETO: Platform Agnostic SEcurity TOkens

2. PASERK: Platform Agnostic SERialized Keys

{
    "wrapped-key": "k4.seal.OPFn-AE[...]RTVc9",
    "payload": "v4.local.osy0wY[...]XIXVt",
    "exp": "2055-01-01T00:00:00+00:00",
    "iat": "2022-06-08T10:00:00-04:00",
    "nbf": "2022-06-08T10:00:00-04:00"
}

Open Source Beyond the PHP Ecosystem

1. Supply Chain Security for Software Updates

2. Other Language Implementations of Our PHP Libraries

Where We're Headed in the Immediate Future

1. Key Discovery for Identity Providers

2. Post-Quantum Cryptography