Wycheproof Laravel Package

Technical Evaluation

Architecture Fit

• Cryptographic Validation Layer: Wycheproof provides a pre-built test suite for validating cryptographic implementations against known attack vectors (e.g., invalid curve attacks, Bleichenbacher flaws, nonce bias). This aligns well with Laravel’s reliance on PHP’s cryptographic libraries (e.g., openssl, libsodium, or custom implementations) for features like:
  • Authentication (e.g., JWT, OAuth tokens)
  • Encryption (e.g., AES-GCM, ChaCha20-Poly1305)
  • Digital Signatures (e.g., ECDSA, EdDSA)
  • Key Exchange (e.g., ECDH, X25519)
• Complementary to Laravel’s Security Stack: While Laravel itself doesn’t implement cryptography from scratch, it delegates to PHP’s ext-openssl, ext-sodium, or packages like paragonie/sodium_compat. Wycheproof can validate these dependencies at build/test time, reducing runtime vulnerabilities.
• CI/CD Integration: Fits naturally into Laravel’s testing pipeline (e.g., PHPUnit, Pest) to enforce cryptographic correctness before deployment.

Integration Feasibility

• Low-Coupling Design: Wycheproof is language-agnostic (JSON-based test vectors). Integration requires:
  1. Loading JSON test vectors (via Guzzle, Symfony\Component\Yaml, or native json_decode).
  2. Mapping vectors to Laravel/PHP crypto APIs (e.g., openssl_* functions, Sodium\* methods).
  3. Asserting outputs against expected results (valid/invalid/acceptable).
• Existing PHP Libraries:
  • web-token/jwt-framework (for JWT validation).
  • paragonie/sodium_compat (for modern crypto).
  • phpseclib/phpseclib (for custom implementations).
  • Challenge: Some algorithms (e.g., AEGIS, Ascon) may require custom PHP bindings or reliance on FFI/PECL extensions.

Technical Risk

Key Questions for the TPM

1. Algorithm Prioritization:
   • Which cryptographic algorithms does Laravel currently use (e.g., JWT signing, database encryption)?
   • Should we mandate Wycheproof coverage for all algorithms or start with high-risk ones (e.g., ECDSA, RSA)?
2. Integration Scope:
   • Should Wycheproof tests run in CI (GitHub Actions/GitLab CI) or local development (e.g., Laravel Sail)?
   • Should we block merges if tests fail (strict mode) or warn only (lenient mode)?
3. Performance Tradeoffs:
   • What’s the acceptable CI runtime for Wycheproof tests? Can we sample vectors instead of running all?
4. False Positive Handling:
   • How will we triage failures (e.g., is PHP’s openssl_* implementation non-compliant, or is Wycheproof’s test incorrect)?
5. Long-Term Maintenance:
   • Who will own Wycheproof updates (Security Team, Core Devs)?
   • Should we fork Wycheproof to customize vectors for Laravel’s needs?

Integration Approach

Stack Fit

• PHP Ecosystem:
  • JSON Handling: Leverage json_decode() or Symfony\Component\Yaml for parsing vectors.
  • Crypto Libraries:
    • OpenSSL: For RSA, DSA, ECDSA, AES, etc. (via openssl_* functions).
    • Libsodium: For modern algorithms (ChaCha20-Poly1305, X25519) via paragonie/sodium_compat.
    • Custom: For unsupported algorithms (e.g., AEGIS), consider:
      • FFI to call native libraries.
      • PECL extensions (e.g., pecl/openssl).
      • External services (e.g., AWS KMS for Kyber).
  • Testing Frameworks:
    • PHPUnit/Pest: For assertions.
    • Laravel’s tests/Feature: To integrate into existing test suites.
• Laravel-Specific:
  • Service Providers: Create a WycheproofServiceProvider to load vectors and register test runners.
  • Artisan Commands: Add php artisan wycheproof:test for manual runs.
  • Facades: Expose a Wycheproof facade for easy test invocation.

Migration Path

1. Phase 1: Proof of Concept (2-4 weeks)

   • Scope: Pick 1-2 algorithms (e.g., AES-GCM + ECDSA) with high Laravel usage.
   • Implementation:
     • Write a custom test runner (e.g., WycheproofTestCase extending PHPUnit).
     • Map Wycheproof vectors to PHP functions (e.g., openssl_encrypt() for AES-GCM).
     • Run tests locally and in CI.
   • Deliverable: PR with a modular test suite for 1 algorithm.

2. Phase 2: Core Integration (4-8 weeks)

   • Scope: Expand to all supported algorithms in Laravel’s crypto stack.
   • Implementation:
     • Automate vector loading (e.g., fetch from GitHub releases).
     • Add CI checks (e.g., fail builds on Wycheproof failures).
     • Document expected behavior for each algorithm.
   • Deliverable: Full Wycheproof integration in Laravel’s testing package.

3. Phase 3: Optimization & Maintenance (Ongoing)

   • Scope: Reduce CI noise, improve performance, and handle schema updates.
   • Implementation:
     • Cache test results for unchanged code.
     • Parallelize tests (e.g., by algorithm).
     • Monitor false positives and file issues upstream.
   • Deliverable: Stable, high-coverage Wycheproof testing in Laravel.

Compatibility