Ecc Laravel Package

Product Decisions This Supports

• Security-Critical Cryptographic Infrastructure:

  • Enable ECDH (Elliptic Curve Diffie-Hellman) for secure key exchange in protocols like TLS, SSH, or custom authentication systems.
  • Implement ECDSA (Elliptic Curve Digital Signature Algorithm) for signing/verifying transactions, API requests, or blockchain-like applications.
  • Support Schnorr signatures (via SchnorrSigner) for modern cryptographic protocols (e.g., Bitcoin Taproot, ZKPs).

• Compliance & Standards Alignment:

  • Adhere to NIST/FIPS 186-5 (ECDSA) and BSI TR-03111 (Brainpool curves) for government/enterprise compliance.
  • Replace legacy RSA/DSA with post-quantum-resistant curves (e.g., secp256k1, nistp384, brainpoolp512r1).

• Build vs. Buy:

  • Buy: Avoid reinventing cryptographic wheels; leverage battle-tested, side-channel-resistant implementations.
  • Customize: Extend for domain-specific use cases (e.g., threshold signatures, multi-party ECDH).
  • Replace: Migrate from mdanter/ecc or openssl to a unified, secure-by-default library.

• Use Cases:

  • Authentication: Passwordless logins via ECDH key exchange.
  • Payments: Secure transaction signing (e.g., crypto wallets, banking APIs).
  • IoT/Embedded: Lightweight cryptography for constrained PHP environments (fallback to pure PHP if OpenSSL unavailable).
  • Blockchain: Custom token/chain implementations needing ECDSA/Schnorr.

When to Consider This Package

Adopt If:

• You need modern elliptic curve cryptography (ECDH/ECDSA/Schnorr) in PHP without native OpenSSL dependencies (or as a fallback).
• Your application requires side-channel-resistant operations (constant-time implementations for secp256k1, nistp384, nistp521).
• You’re building security-sensitive systems (e.g., wallets, auth, compliance-bound apps) and want to avoid footguns like insecure curves.
• You’re migrating from mdanter/ecc or easy-ecc and need a drop-in replacement with hardened defaults.
• Your stack uses PHP 7.1+ (or 8.0+ for OpenSSL 3.0+ optimizations) and GMP extension.

Look Elsewhere If:

• You only need high-level abstractions: Use paragonie/easy-ecc (simpler API, built on top of phpecc).
• You’re in a performance-critical path and can use native OpenSSL (faster than pure PHP).
• You need post-quantum algorithms: This package focuses on ECC; consider hybrid schemes (e.g., Kyber + ECDSA).
• Your environment lacks GMP extension (required for pure PHP mode).
• You’re targeting PHP < 7.1 (minimum version requirement).

How to Pitch It (Stakeholders)

For Executives:

*"This is a drop-in, enterprise-grade PHP library for elliptic curve cryptography (ECC), critical for securing authentication, payments, and compliance-bound systems. It replaces risky custom implementations or outdated libraries with:

• Side-channel-resistant ECDH/ECDSA/Schnorr (hardened against timing attacks).
• NIST/BSI-compliant curves (e.g., brainpoolp512r1 for German government standards).
• OpenSSL fallback for performance where available, with pure PHP as a secure alternative.
• Zero dependents means no hidden risks; it’s a battle-tested fork of the original mdanter/ecc.

Why now?

• Migrate legacy RSA/DSA to quantum-resistant ECC.
• Avoid cryptographic vulnerabilities (e.g., insecure curves, biased k values in ECDSA).
• Future-proof with Schnorr signatures (used in Bitcoin Taproot).

Risk: Minimal—used in production by security-conscious teams (e.g., Paragon Initiative)."*

For Engineers:

*"paragonie/ecc gives you low-level control over ECC operations while enforcing security best practices:

• Default-deny insecure curves (e.g., nistp192 blocks by default; opt-in required).
• Constant-time arithmetic for secp256k1, nistp384, nistp521 (mitigates timing attacks).
• OpenSSL 3.0+ integration (PHP 8.1+) for performance, with pure PHP fallback.
• Schnorr signatures (new in v2.4) for modern protocols.

Key Tradeoffs:

• Pros: Secure-by-default, no footguns, supports Brainpool curves.
• Cons: Steeper learning curve than easy-ecc; pure PHP mode is slower than OpenSSL.

Integration:

composer require paragonie/ecc:^2

Example Use Case:

// ECDH Key Exchange (secure)
$alicePrivate = EccFactory::getSecgCurves()->generator256()->randomPrivateKey();
$alicePublic  = $alicePrivate->getPublicKey();
$bobPrivate   = EccFactory::getSecgCurves()->generator256()->randomPrivateKey();
$sharedSecret = $alicePrivate->getSharedSecret($bobPrivate->getPublicKey());

// ECDSA Signing (compliant)
$signer = new \Mdanter\Ecc\Crypto\Signature\Signer\Ecdsa\Sha256();
$signature = $signer->signWithKey($privateKey, $message);
$valid = $signer->verifyWithKey($publicKey, $message, $signature);

When to Use:

• You need raw ECC operations (not just high-level abstractions).
• You’re building custom crypto protocols (e.g., threshold signatures).
• You want auditable, side-channel-hardened code.

Alternatives:

• Use easy-ecc if you prefer a simpler API.
• Use OpenSSL directly if performance is critical and your environment supports it."*