hernandev/laravel-aead

Advanced Encryption with Associated Data (AEAD) for Laravel.

LaravelAEAD.

LaravelAEAD is a library which provides Advanced Encryption with Associated Data (AEAD) for Laravel., _(*1)

Abstract:

This package replaces, when installed and enabled, the default encryption implementation of Laravel, which currently supports only two variants of the same block cipher, AES-128-CBC and AES-256-CBC., _(*2)

The reason for only having two options is probably based on PHP history itself, like the (not so much) rececent depreciation of MCrypt., _(*3)

As of PHP 7.2, we can now count on the exceptional libsodium extension, with supports the most secure AEAD construtions and it's variants., _(*4)

AEAD stands for Advanced Encryption, with Associated Data, and they are algorithms which combine a stream cipher with a message authentication code (MAC)., _(*5)

The result of such combination is a encryption scheme with provides three aspects that are useful for modern applications: - Confidentiality - Integrity - Authenticity, _(*6)

For more information on AEAD, I highly recommend reading the libsodium documentation, which states the main parts, but, reading the construction IETF RFC's is also something interesting if you care for security., _(*7)

Available Constructions.

Those are the libsodium AEAD constructors, and they respective key for usage with this package., _(*8)

Installing & Configuring.

Installing the Library., _(*9)

composer require hernandev/laravel-aead

Changing the authentication provider (on config/app.php):, _(*10)

    // YOU MUST COMMENT OUT THE DEFAULT ENCRYPTION CLASS>
    // Illuminate\Encryption\EncryptionServiceProvider::class,
    // THIS ONE SHOULD BE USED INSTEAD.
    LaravelAEAD\Providers\EncryptionServiceProvider::class,

Configuring the cipher (also on config/app.php):, _(*11)

    'cipher' => 'XCHACHA20-POLY1305-IETF',

Usage.

After doing this install, all default Laravel encryption will be performed under the relative constructions / ciphers., _(*12)

Meaning if you use encrypt() and decrypt(), they will use this package instead of the default encryption., _(*13)

It also means that cookies & session, that should be encrypted, will use it., _(*14)