Weave Code
Ciphersweet Laravel Package
paragonie/ciphersweet
CipherSweet is a PHP library for fast, secure field-level encryption with searchable encrypted indexes. Designed for applications that need to protect sensitive data at rest while still supporting equality and range queries, with strong cryptography and clean integrations.
Fast, searchable field-level encryption for PHP projects
Frequently asked questions about Ciphersweet
- How do I integrate CipherSweet with Laravel’s Eloquent for field-level encryption?
- CipherSweet requires custom Eloquent accessors/mutators to encrypt/decrypt fields. Use `getAttribute()` and `setAttribute()` to handle ciphertext storage. For a smoother experience, pair it with a wrapper like `spatie/laravel-ciphersweet`, which provides Eloquent traits and query builder helpers. Ensure your database schema includes `ciphertext`, `salt`, and `nonce` columns for each encrypted field.
- Can I search or filter encrypted fields in Laravel queries?
- Yes, but with limitations. CipherSweet supports deterministic encryption for searchable fields, but complex queries (e.g., `LIKE`, `JOIN`) may require application-layer decryption or database-specific functions like PostgreSQL’s `pgcrypto`. For full-text search, decrypt data in-memory or use a hybrid approach with partial indexes. Avoid relying on native SQL indexes for encrypted columns.
- What Laravel versions and PHP requirements does CipherSweet support?
- CipherSweet is designed for PHP 8.1+ and Laravel 8.0+. Older versions (Laravel <8.0 or PHP <8.1) may need polyfills or forks, as it leverages modern cryptographic primitives like ChaCha20-Poly1305. Always test thoroughly in your target environment, as backward compatibility isn’t guaranteed for pre-8.1 setups.
- How do I manage encryption keys in Laravel with CipherSweet?
- Keys are typically stored in environment variables (e.g., `.env`) or a Key Management System (KMS) like AWS KMS. Laravel’s `.env` integration works well, but key rotation isn’t built-in—you’ll need to implement a custom solution or use a KMS provider. Avoid hardcoding keys and consider using Laravel’s `config('services.kms')` for cloud-based key management.
- Will CipherSweet work with my existing MySQL/PostgreSQL database schema?
- No, schema changes are required. You’ll need to add columns for `ciphertext`, `salt`, and `nonce` for each encrypted field. For PostgreSQL, the `paragonie/ciphersweet-db` package adds database-level support (e.g., `pgcrypto` integration), but MySQL relies entirely on application-layer decryption. Plan migrations carefully, especially for production systems.
- Is CipherSweet compatible with Laravel’s caching (Redis, Memcached)?
- No, encrypted data cannot be cached directly in Redis or Memcached because decryption happens at runtime. Cache only non-sensitive metadata or use edge caching for decrypted responses. For high-throughput apps, benchmark decryption latency to avoid performance bottlenecks during peak loads.
- How does CipherSweet handle decryption failures (e.g., corrupted ciphertext or lost keys)?
- Decryption failures will throw exceptions by default. Implement graceful degradation (e.g., logging errors, returning null, or falling back to plaintext) based on your security requirements. For critical data, consider adding checksums or integrity checks to detect corruption early. Always test failure scenarios in staging.
- Can I use CipherSweet for full-text search on encrypted fields in Laravel?
- Not natively. Encrypted fields cannot use SQL full-text indexes. Workarounds include decrypting data in-memory and searching locally, or using a hybrid model (e.g., storing a searchable hash alongside encrypted data). For PostgreSQL, consider `tsvector` on decrypted columns, but this requires careful access control.
- What are the performance implications of CipherSweet in high-traffic Laravel apps?
- CipherSweet uses ChaCha20-Poly1305, which is faster than AES-GCM but still adds CPU overhead. Benchmark your encrypted queries against unencrypted baselines, especially for high-concurrency environments. Database locks or slow decryption may occur under load—optimize with connection pooling or async decryption where possible.
- Are there alternatives to CipherSweet for Laravel field-level encryption?
- Yes, alternatives include `spatie/laravel-encryption` (simpler but less searchable), `tightenco/ziggy` (for API token encryption), or database-native solutions like PostgreSQL’s `pgcrypto` or MySQL’s `AES_ENCRYPT`. CipherSweet stands out for searchable encryption and modern cryptography, but evaluate trade-offs like schema complexity and query flexibility for your use case.
Weaver
How can I help you explore Laravel packages today?