Weave Code
Cose Lib Laravel Package
web-auth/cose-lib
CBOR Object Signing and Encryption (COSE) library for PHP with full support for COSE_Sign1, Sign, Encrypt0, Encrypt, Mac0 and Mac tags, plus ECDSA, EdDSA, RSA, HMAC algorithms. PHP 8.1+ and WebAuthn/FIDO2 compatible.
web-auth/cose-lib is a comprehensive PHP library implementing CBOR Object Signing and Encryption (COSE) as defined in RFC 9052, RFC 9053, and RFC 9864. It provides full support for COSE signing, encryption, and MAC operations, with modern PHP 8.1+ strict typing and PHPStan compliance.
- Complete COSE tag support: Sign1, Sign, Encrypt0, Encrypt, Mac0, and Mac
- Signature algorithms: ECDSA (ES256/384/512, ES256K), EdDSA (Ed25519/448), RSA (RS/PS 256/384/512), plus RFC 9864 fully-specified identifiers
- HMAC with SHA-256/384/512 for MAC operations
- Compatible with WebAuthn, FIDO2, and digital COVID certificates
- Comprehensive test coverage
composer require web-auth/cose-lib
Frequently asked questions about Cose Lib
- How do I install web-auth/cose-lib in a Laravel project?
- Install it with Composer by running composer require web-auth/cose-lib. The package requires PHP 8.1 or newer and has no Laravel-specific dependencies. If you plan to work with COSE tag objects such as CoseSign1Tag, also install spomky-labs/cbor-php. After installation you can use the Cose classes directly or bind them in your own Laravel service provider.
- Which PHP and Laravel versions does web-auth/cose-lib support?
- The library targets PHP 8.1+ with strict types and has no framework coupling, so it works with Laravel 10, 11, and other modern releases running a supported PHP version. There is no Laravel service provider shipped in the package, so version support is effectively driven by your PHP version and Composer constraints rather than a Laravel release matrix.
- What COSE tags and cryptographic algorithms does web-auth/cose-lib support?
- It supports COSE_Sign1 (tag 18), COSE_Sign (tag 98), COSE_Encrypt0 (tag 16), COSE_Encrypt (tag 96), COSE_Mac0 (tag 17), and COSE_Mac (tag 97). Algorithms include ECDSA (ES256/384/512, ES256K), EdDSA (Ed25519, Ed448), RSA (RS256/384/512, PS256/384/512), and HMAC with SHA-256/384/512. Fully-specified identifiers from RFC 9864 such as ESP256 and Ed25519 are also covered.
- Can I use web-auth/cose-lib to verify WebAuthn or FIDO2 attestation objects?
- Yes. WebAuthn and FIDO2 attestation and assertion flows rely heavily on COSE_Sign1 and the algorithms this library implements, including ES256 and EdDSA. You decode the CBOR attestation object, verify the COSE_Sign1 signature with the credential public key, and check the authData and RP ID hash yourself. The library handles the COSE cryptographic layer, while WebAuthn ceremony validation remains your application's responsibility.
- How do I verify a COSE_Sign1 signature in Laravel?
- Decode the CBOR payload with spomky-labs/cbor-php using a TagManager that includes CoseSign1Tag, then extract the COSE_Sign1 structure and its protected headers. Verify the signature against the credential public key using the Sig_structure built from the protected header, payload, and external AAD. In Laravel, wrap this in a dedicated service class so controllers stay thin and the verification logic can be unit tested.
- Do I need spomky-labs/cbor-php to use COSE tag objects?
- Yes, COSE tag support depends on spomky-labs/cbor-php. Install it with composer require spomky-labs/cbor-php and register the COSE tag classes, such as CoseSign1Tag, in the CBOR TagManager before decoding. Without it you can still work with raw structures, but you lose the convenient tag-aware decoding path shown in the README.
- How do I register web-auth/cose-lib as a service or facade in Laravel?
- Because the package is framework-agnostic, register a wrapper class or a configured decoder as a singleton in a service provider. A facade is just a thin class that resolves that binding, so calls read like Cose::verifySign1($data, $key). Keep the wrapper focused on your domain operations rather than exposing every COSE class directly.
- Can web-auth/cose-lib verify EU Digital COVID Certificates?
- Yes. EU Digital COVID Certificates are CBOR-encoded, COSE_Sign1-signed payloads, typically using ES256, which this library supports. You decode the CBOR, verify the COSE_Sign1 signature with the issuing authority's public key from the trust list, then parse the claims inside the payload. Certificate validity rules, trust-list handling, and claim validation remain application concerns outside the library.
- How should I test COSE signing and verification in a Laravel application?
- Generate or load test key pairs for each algorithm family you support, then sign and verify round trips through the library to confirm your integration works. Use known COSE test vectors where possible so you are not just testing your code against itself. In Laravel, run these as feature tests against your wrapper service and include negative cases such as tampered payloads, wrong keys, and mismatched protected headers.
- Is web-auth/cose-lib actively maintained and safe for production use?
- The package is part of the web-auth ecosystem used by web-auth/webauthn-lib, follows strict typing and PHPStan checks, and ships with CI and comprehensive test coverage, which makes it a reasonable production choice for COSE operations. It is a focused cryptographic library, so key management, trust stores, and input validation remain your responsibility. For raw CBOR without COSE semantics, spomky-labs/cbor-php covers that lower layer, while web-auth/webauthn-lib builds on this package for full WebAuthn server flows.
Weaver
How can I help you explore Laravel packages today?