Elliptic Php Laravel Package

Getting Started

Install via Composer (if available on Packagist — verify repository legitimacy first):

composer require simplito/elliptic-php

Start with core use cases: key generation and ECDSA signing on secp256k1 (Bitcoin-compatible):

use Elliptic\EC;

$ec = new EC('secp256k1');
$keyPair = $ec->genKeyPair();
$message = 'Hello from Laravel';
$signature = $keyPair->sign($message, 'hex'); // DER-encoded
$isValid = $keyPair->verify($message, $signature, 'hex');

Inspect the examples/ directory in the repo for quickstarts on key export, signing Ethereum-style messages, or public key recovery.

Implementation Patterns

• Wallet Integration: Generate keypairs and derive addresses using secp256k1 + custom SHA-256/Ripemd160 hashing (or pair with web3p/ethereum-cryptography for full Ethereum compatibility).
• JWT with ES256K: Override firebase/php-jwt’s sign/verify callbacks to delegate to elliptic-php, enabling Bitcoin-style JWTs for decentralized identity workflows.
• Deterministic Key Generation: Chain with BIP39/BIP44 logic (e.g., web3p/bip39) to derive HD wallet paths (m/44'/0'/0'/0/0) for multi-account crypto apps.
• Low-Level Protocol Work: When interfacing with blockchain tx data (e.g., raw Ethereum transactions), use sign($msg, 'hex', ['canonical' => true]) and manually pad r/s to 32 bytes for r||s concatenation.

Gotchas and Tips

• Curve name sensitivity: 'ed25519' (not 'Ed25519'), 'secp256k1' (not 'secp256k1' with extra space) — typos silently fall back to defaults or cause cryptic errors.
• Signature format mismatch: DER is not standard for most blockchains. For secp256k1, extract r/s from DER using Elliptic\Signatures\ECDSA::parseSignature() (or decode hex DER manually) and re-encode as 32-byte r + 32-byte s.
• Performance: Cache EC instances (e.g., singleton in Laravel’s service container) — constructing new instances per request triggers expensive curve parameter loading. Enable ext-gmp; fallback to bcmath is 5–10× slower.
• PEM import is manual: Strip -----BEGIN ...-----, base64-decode the payload, and feed raw bytes to keyFromPrivate() — the library provides no helper for PEM headers.
• Verify safety: Always wrap verify() in try/catch — malformed DER or invalid public keys may throw TypeError or Exception, not return false.