In a recent vote of PHP’s core developers, it was decided to integrate libsodium, a modern cryptographic library offering a comprehensive set of high-level security APIs for developers of PHP application.
PHP is the language of much of the web. Many of its most popular applications and frameworks are written in PHP, including WordPress, which accounts for 27% of all sites on the web. PHP runs on millions of shared hosting accounts, virtual private servers, and dedicated servers. And yet, the built-in cryptography options for the world’s most popular server-side language aren’t all that impressive.
PHP makes a number of functions available for generating random strings, encryption, and hashing. Some of the most important of those functions are based on OpenSSL, a venerable but troubled cryptography library. If you think back a couple of years, you’ll remember the Heartbleed vulnerability, and that’s far from the only security catastrophe that can be blamed on OpenSSL.
Libsodium is a fork of NaCl, a security library created by Daniel J. Bernstein, a respected computer scientist and cryptographer. NaCl’s creation was prompted by OpenSSL’s shortcomings and a desire to see simple but correct encryption tools made more widely available. Libsodium offers an improved, easy-to-use API for most common applications of cryptography in web apps.
To take just one advantage libsodium has over the current state of PHP cryptography: The OpenSSL extension to PHP only supports RSA, even when OpenSSL itself has support for elliptic curve cryptography. Libsodium includes high-speed constant-time elliptic curve algorithms.
Libsodium has been available in PECL for quite some time, but its integration into PHP proper is a major step forward. PHP is used by developers of all abilities. Without a high-quality modern cryptographic library available in PHP, there’s a risk developers will build their own cryptography solutions — always a bad idea — or simply rely on the existing tools.
Libsodium was built with ease-of-use in mind. With the current mix of cryptographic functions in PHP, it’s often not clear to inexperienced developers which functions are right to use in which circumstances, which can lead to supposedly secure software not being secure at all — the worst possible combination for any web application handling sensitive data.
Additionally, because it’s quite difficult to implement decent encryption in PHP, many developers don’t make the attempt. In today’s online environment, the correct encryption of private data is vitally important. Libsodium’s PHP integration will offer a simple cryptography front-end that aims to be usable by developers without requiring them to understand the complexities of the underlying cryptographic algorithms.
Bringing libsodium into PHP and making it available to anyone who installs a new version of PHP means the best cryptography is available out of the box.