(See Laravel/Internals repository instead!)

[paragonie-scott]

I've been working on a pure PHP implementation of the cryptography features offered by libsodium. It rests at paragonie/sodium_compat.

One important detail: sodium_compat opportunistically uses the PHP extension in PECL if it exists. Additionally, sodium_compat includes a lot of built-in design decisions to reduce the risk of cache-timing vulnerabilities.

The algorithms implemented include:

• Symmetric Cryptography
  • HMAC-SHA-512-256 (crypto_auth())
  • Xsalsa20-Poly1305 (crypto_secretbox())
• Asymmetric Cryptography
  • Ed25519 (EdDSA over Curve25519) (crypto_sign())
  • X25519 (ECDH over Curve25519) (crypto_scalarmult(), crypto_kx())
  • X25519-Xsalsa20-Poly1305 (crypto_box(), crypto_box_seal())
• Other Cryptography
  • BLAKE2b (crypto_generichash(), etc.)
  • SipHash-2-4 (crypto_shorthash())

However, sodium_compat has yet to be audited by an independent third party. I'm filing an issue now to kick off any planning or discussion necessary to make sodium_compat available to Laravel users as soon as it gets audited. (I'd also like to gauge interest in seeing this in a future Laravel release.)

[themsaid]

Thank you :)

But suggestions are posted on the https://github.com/laravel/internals repo.

[GrahamCampbell]

I think it's very unlikely Laravel will be making any major changes like this in 2017. We've still got users recovering from the migration away from mcrypt. If Laravel does switch in the future, I think it'd be important that the library is stable and mature.

[paragonie-scott]

@GrahamCampbell Sure, but when the day does arrive (after v1.0.0 is tagged, which won't happen unless/until it passes a cryptography audit), here's the recommendation.

Opened laravel/ideas#374 in the correct place.