- How do I install grafite/crypto in a Laravel application?
- Run composer require grafite/crypto from your project root. Laravel's package discovery registers the service provider and facade automatically, so no manual wiring is needed in a standard app. Then publish the package config with php artisan vendor:publish and set your key material. On Lumen you have to register the provider yourself.
- Does grafite/crypto support Laravel 10 and Laravel 11?
- The repository is archived and its composer constraints predate Laravel 10 and 11, so expect Composer to refuse the install on a modern app. Plan on widening the illuminate/support and PHP version constraints, updating a stale phpseclib dependency, and fixing deprecation notices before a single line of feature code runs. Budget roughly a day, and treat the result as a vendored fork rather than a normal dependency.
- How is grafite/crypto different from Laravel's built-in Crypt facade?
- Laravel's Crypt facade is a symmetric encrypter for values you already hold, and it does not generate keypairs or perform public-key operations. Grafite Crypto is a thin helper layer that adds asymmetric keypair generation, public and private key encryption, signing, and hashing on top of PHP crypto primitives. If all you need is encrypting a string at rest, the framework's built-in encrypter is the safer choice.
- Is grafite/crypto safe to use in production?
- The package is archived, has roughly ten stars and zero dependents, which means it has had essentially no adversarial review. That is proportionate for non-regulated payloads such as internal service-to-service tokens or a small opaque blob for a partner integration. It is not appropriate for PII, PCI, or PHI data, or for any environment with a FIPS 140-2/3, HSM, or KMS key-custody mandate, because a single-maintainer wrapper cannot satisfy those controls.
- Which encryption algorithms does grafite/crypto use?
- The package is a thin wrapper over PHP crypto primitives, historically OpenSSL or phpseclib, rather than a from-scratch implementation. Read the source before trusting it and confirm it uses an authenticated mode such as AES-GCM or sodium_crypto_secretbox rather than CBC with hand-rolled padding, which invites padding-oracle attacks. There is no published crypto review and no SECURITY.md to lean on.
- How do I register grafite/crypto's service provider and facade in Lumen?
- Lumen does not support package discovery, so add the Grafite service provider to bootstrap/app.php and, if you want the facade, register its class alias in the same file. Enable facades with $app->withFacades() on Lumen versions that still require it. Then copy or publish the package config so the key settings are resolvable from the container.
- Where should I store the private keys generated by grafite/crypto?
- The package can generate a keypair but says nothing about custody, and that is an infrastructure decision rather than a package one. Keep private keys in a secrets manager or KMS, inject them at runtime through environment variables, and never commit them or write them to the application filesystem. If the only plan is a key in .env on the app tier, that is a control failure regardless of how sound the crypto is.
- How do I test code that depends on grafite/crypto?
- Do not call the facade directly from feature code, or your tests will depend on real key material and on a package that may not install on newer Laravel versions. Define an interface such as CryptoBox with seal, open, sign, and verify methods, implement it with grafite/crypto, and bind a fake implementation in the test container. That keeps tests fast and lets you swap in Laravel Crypt, sodium, or a cloud KMS later.
- Is grafite/crypto still maintained, and what should I use instead?
- No, the GitHub repository is archived, there is no security disclosure path, and any vulnerability in a transitive dependency becomes yours to patch. Laravel's Crypt facade, PHP's sodium extension, defuse/php-encryption, phpseclib called directly, and a cloud KMS cover most of what this package offered. Choose one of those unless you specifically need its asymmetric helpers and are willing to own a fork indefinitely.
- How do I keep grafite/crypto from leaking into my domain code?
- Wrap the facade immediately behind an internal port, for example App\Contracts\CryptoBox with seal, open, sign, and verify methods, and implement that port with grafite/crypto behind a feature flag. This costs about a day and buys the ability to swap the implementation for Laravel Crypt, PHP sodium, or AWS KMS without touching call sites. It also concentrates the crypto dependency in one place for review.