Epicrypt 2.0

Epicrypt provides authenticated data protection, token security, password security, integrity primitives, and certificate tooling for PHP 8.4 and later.

Complete-path examples

• Certificates and key exchange: create a CA, issue a service certificate, and validate it before deployment.

• Cryptographic primitives: sign, encrypt, decrypt, and authenticate a service message.

• Data protection: protect a database value and renew it through key rotation.

• Secure generation and key derivation: derive purpose-isolated keys and use them for protection and authentication.

• Integrity: publish and verify a signed release manifest and artifact.

• Password security: register, authenticate, and transparently rehash a password.

• Application security: issue and atomically consume a single-use password-reset token.

• Complete OAuth token lifecycle: issue and verify access tokens, rotate refresh tokens, bind DPoP, narrow scopes, and revoke authorization.

• Error Handling: map cryptographic failures at an application boundary.

Internal is not a consumer capability and intentionally has no public integration example.

• Getting started
• Architecture
  • Capability-First Model
  • Core Rule
  • Named Backend Selection
  • Contracts and Ownership
  • Public vs Internal
  • Security Design Principles
• Security recommendations
• Certificates and key exchange
  • Complete path: create a CA, issue a leaf, and validate deployment
  • Issue a short-lived service certificate
  • Create and inspect a CA-signed certificate
  • Derive a service-to-service session key
  • Directional Sodium crypto_kx session keys
  • OpenSSL ECDH with context-bound HKDF
  • Advanced Ristretto255 protocol primitives
• Cryptographic primitives
  • Complete path: sign and encrypt a service message
  • AEAD
  • Shared-key and public-key boxes
  • Detached signatures and MACs
  • Authenticated file streaming
  • Binary encoding
• Data protection
  • Complete path: protect, read, and renew a rotated database value
  • Protect a database field
  • Use envelope protection for independently generated data keys
  • Protect a database backup without loading it into memory
  • Rotate keys with policy metadata
  • Explicit algorithm selection
• Secure generation and key derivation
  • Complete path: derive and use purpose-isolated application keys
  • Generate purpose-sized material
  • Derive isolated keys from one root key
• Integrity
  • Complete path: publish and verify a signed release manifest
  • Verify a downloaded release artifact
  • Authenticate a webhook body
• Password security
  • Complete path: register, authenticate, and upgrade credentials
  • Register, log in, and upgrade a stored hash
  • Validate or generate a password
  • Protect a recoverable application secret
  • Explicit algorithm selection
• Application security
  • Complete path: issue and consume a single-use password reset
  • Create a method- and host-bound download URL
  • Protect a browser session from CSRF
  • Issue purpose-bound account tokens
  • Rotate signing keys with a typed KeyRing
• Tokens and JWT
  • Supported algorithms
  • Complete path: issue and verify an access token across a service boundary
  • Use symmetric JWT inside one trust boundary
  • Publish an asymmetric verification key as JWK
  • Issue and rotate an opaque refresh token
  • Implement JWT replay and denylist storage
  • Sign short-lived application state
  • Sign a detached webhook and require multiple signatures
  • Publish and rotate a certificate-bound JWKS
  • Resolve remote JWKS with safe rollover
  • Encrypt PII and nest a signed JWT
  • Validate an OpenID Connect login
  • Bind an API request with DPoP
• Complete OAuth token lifecycle
  • One-time service setup
  • Initial token endpoint response
  • Resource-server request
  • Refresh-token endpoint
  • Logout and security-event revocation
  • DPoP-bound token endpoint requests
• Token persistence contracts
  • Public refresh-token types
  • Adapter conformance
  • Recommended relational model
  • Atomic rotation sequence
  • Authorization endpoint integration
  • JWT replay and denylist store
  • Deployment checklist
• Error Handling
  • Complete path: map a protected read at the service boundary
  • Root
  • Main Capability Exceptions
  • Important Specialized Exceptions
  • Recommended Catch Strategy
  • OAuth Refresh-Token Results
• Benchmarking
  • Benchmark Commands
  • Benchmark Suite Location
  • Notes for Useful Numbers
  • Typical Workflow