Shh Laravel Package

Product Decisions This Supports

• Secrets Management Roadmap: Accelerates development of a self-hosted secrets vault or secure configuration system by providing a lightweight, PHP-native encryption layer. Ideal for teams building internal tools where AWS KMS/HashiCorp Vault may be overkill.
• Build vs. Buy: Justifies not reinventing encryption wheels for internal use cases (e.g., encrypting database credentials, API keys, or PII in logs). Reduces reliance on external SaaS secrets managers for low-risk, high-frequency secrets.
• Compliance Use Cases:
  • Encrypting secrets at rest (e.g., Laravel .env files, config files in CI/CD pipelines).
  • Audit-friendly key generation (passphrase-protected keys with configurable algorithms like sha256/sha512).
  • Multi-tenant SaaS: Encrypt tenant-specific secrets (e.g., database credentials) with tenant-scoped key pairs.
• Legacy System Integration: Enables secure migration of monolithic PHP apps to modern stacks by encrypting legacy secrets without full secrets manager overhaul.
• Edge Cases:
  • Air-gapped environments: Works offline (no cloud dependencies).
  • Temporary secrets: Ephemeral key pairs for short-lived credentials (e.g., OAuth tokens).

When to Consider This Package

Adopt When:

• Your team needs PHP-native encryption for secrets without external dependencies (e.g., no AWS KMS, HashiCorp Vault, or Azure Key Vault).
• You’re building a lightweight secrets manager (e.g., for internal tools, CI/CD, or legacy systems) and want to avoid vendor lock-in.
• Compliance requires on-premise or self-managed encryption (e.g., GDPR, HIPAA for PII handling).
• You need simple, auditable key management (e.g., passphrase-protected keys with configurable algorithms).
• Performance is critical: OpenSSL-backed encryption is faster than some cloud-based alternatives for bulk operations.

Look Elsewhere When:

• You need hardware-backed security (e.g., HSMs) or FIPS 140-2 compliance (this package uses OpenSSL but doesn’t guarantee hardware enforcement).
• Your use case requires centralized secrets rotation (e.g., automatic key renewal). This package is manual-only.
• You’re encrypting high-value secrets (e.g., cryptocurrency keys) where multi-party access is needed (this is single-key pair only).
• You need integration with existing secrets managers (e.g., syncing with AWS Secrets Manager or HashiCorp Vault).
• Active maintenance is a priority: Last release was 2021 (though OpenSSL is stable, PHP ecosystem moves fast).
• You require advanced features like:
  • Access control (e.g., RBAC for decryption).
  • Secret versioning or revocation.
  • Multi-cloud key storage.

How to Pitch It (Stakeholders)

For Executives:

"We’re proposing bentools/shh, a lightweight PHP library to encrypt/decrypt secrets using OpenSSL. This lets us:

• Secure internal tools (e.g., CI/CD configs, legacy app credentials) without SaaS dependencies.
• Reduce risk by keeping secrets encrypted at rest with auditable key generation (passphrase-protected, configurable algorithms).
• Cut costs vs. secrets managers for low-risk use cases (e.g., encrypting 10K+ secrets in a monolith).
• Future-proof our stack by avoiding vendor lock-in (e.g., AWS KMS price hikes or API changes). This is a low-risk, high-reward play for compliance, cost, and technical debt reduction. We’ll pilot it for [specific use case, e.g., ‘encrypting database credentials in our PHP microservices’] and measure adoption."

For Engineering:

"bentools/shh gives us:

• PHP-native RSA encryption (no external services) for secrets like API keys, DB credentials, or PII in logs.
• Simple API:

  [$publicKey, $privateKey] = Shh::generateKeyPair('passphrase');
  $encrypted = Shh::encrypt('secret', $publicKey);
  $decrypted = Shh::decrypt($encrypted, $privateKey);
  

• Configurable security: Choose sha256/sha512 and key lengths (256–4096 bits).
• No dependencies: Pure OpenSSL, works in air-gapped environments. Tradeoffs: No built-in rotation or multi-user access (we’d need to layer that on top). Best for self-managed secrets where we control key storage (e.g., encrypted files, HashiCorp Vault). Let’s use it for [X] and compare it to [Y] for [Z] use case."*

Key Selling Points:

• Speed: OpenSSL-accelerated (faster than some cloud APIs for bulk ops).
• Control: No third-party access to keys or secrets.
• Flexibility: Works with any PHP app (Laravel, Symfony, or raw PHP).