PHP Function Sodium_Memzero

When you need to encrypt or authenticate something in PHP, you have many options. You can use a password hash to store the password, for example, and prevent side-channel attacks. You can also use an elliptic curve to perform key exchange, or you can even use authenticated encryption with AES-GCM. Depending on your needs, you might want to use a different cryptography library.

Libsodium is one of those libraries, and it has some advantages over other ones. Unlike OpenSSL, it is an "opinionated" cryptography library, meaning that it only uses algorithms that are proven to be secure. That includes Argon2i, which is resistant to GPU-cracking attacks. Libsodium is also portable, cross-compilable, and installable as a PECL extension or as part of the core since PHP 7.2.

In addition to a cipher block chaining algorithm, libsodium also supports message authentication code (MAC), cryptographic hashes, and digital signatures. With the release of PHP 8.1, a new set of functions were added to enable direct XChaCha20 stream encryption with Poly1305 authentication (i.e., chosen ciphertext attacks are protected).

If you need to support older versions of PHP, or if you want to use the same APIs regardless of whether libsodium is available, you can consider using the ParagonIE_Sodium_Compat library as a polyfill for libsodium. The polyfill opportunistically replaces ext/sodium with its implementation if it is installed, and otherwise uses the standard PHP extension or PECL extension as before. For further reading, the official libsodium documentation is here.