AXIAM PHP SDK

FfiOpaqueNative
in package
implements OpaqueNativeInterface

FinalYes

The real FFI binding to `libaxiam_opaque_ffi`.

Deliberately the thinnest layer in this package. Everything above it — exchange lifecycle, key-stretching selection, error mapping — lives in classes a test can drive against a fake OpaqueNativeInterface. What is here needs the actual shared library to exercise, so there is as little of it as the job allows, and the two rules it has to get right are stated where they are implemented:

  1. Every char * the library returns is Rust-allocated and must be freed exactly once. self::take() copies it into a PHP string and frees it, on every path including the failure ones — a binding that freed only on success would leak once per failed login, which is the login rate an installation under attack sees.
  2. A state handle is consumed by its finish, success or failure. This class does not free one afterwards; OpaqueExchange is what guarantees it is never used twice.

Table of Contents

Interfaces

OpaqueNativeInterface
The `libaxiam_opaque_ffi` C ABI, expressed in PHP terms.

Methods

available()  : bool
Whether this build can perform OPAQUE.
ksfArgon2id()  : object|int|null
Builds an Argon2id key-stretching handle, or `null` when the parameters are refused.
ksfFree()  : void
Releases a key-stretching handle.
ksfScrypt()  : object|int|null
Builds a scrypt key-stretching handle, or `null` when the parameters are refused.
lastError()  : string
The library's description of the last failure, borrowed and never freed here.
loginFinish()  : string|null
Completes a login, CONSUMING `$state`.
loginFree()  : void
Releases login state that was never finished.
loginStart()  : array{0: mixed, 1: string}|null
Begins a login, returning the state handle and the hex `KE1`.
open()  : self|null
Binds the library at `$path`, or returns `null` when it cannot be loaded.
registrationFinish()  : string|null
Completes an enrolment, CONSUMING `$state` whether it succeeds or fails.
registrationFree()  : void
Releases enrolment state that was never finished.
registrationStart()  : array{0: mixed, 1: string}|null
Begins an enrolment, returning the state handle and the hex `RegistrationRequest`.

Methods

available()

Whether this build can perform OPAQUE.

public available() : bool
Return values
bool

ksfArgon2id()

Builds an Argon2id key-stretching handle, or `null` when the parameters are refused.

public ksfArgon2id(int $memoryKib, int $iterations, int $parallelism) : object|int|null
Parameters
$memoryKib : int
$iterations : int
$parallelism : int
Return values
object|int|null —

an opaque handle the caller passes back, or null when refused

ksfFree()

Releases a key-stretching handle.

public ksfFree(mixed $ksf) : void
Parameters
$ksf : mixed

ksfScrypt()

Builds a scrypt key-stretching handle, or `null` when the parameters are refused.

public ksfScrypt(int $logN, int $r, int $p) : object|int|null
Parameters
$logN : int
$r : int
$p : int
Return values
object|int|null —

an opaque handle the caller passes back, or null when refused

lastError()

The library's description of the last failure, borrowed and never freed here.

public lastError() : string
Return values
string

loginFinish()

Completes a login, CONSUMING `$state`.

public loginFinish(mixed $state, string $password, string $ke2, mixed $ksf) : string|null

A null return is the whole of the client's authentication check — see OpaqueNativeInterface::loginFinish(). Nothing may be sent to login/finish after it (CONTRACT.md §23.4 rule 7).

Parameters
$state : mixed
$password : string
$ke2 : string
$ksf : mixed
Return values
string|null —

the hex KE3, or null

loginFree()

Releases login state that was never finished.

public loginFree(mixed $state) : void
Parameters
$state : mixed

loginStart()

Begins a login, returning the state handle and the hex `KE1`.

public loginStart(string $password) : array{0: mixed, 1: string}|null
Parameters
$password : string
Return values
array{0: mixed, 1: string}|null —

the state handle and the hex KE1, or null when refused

open()

Binds the library at `$path`, or returns `null` when it cannot be loaded.

public static open(string $path) : self|null

Reports rather than throwing because absence is normal: ext-ffi is optional and the library is a per-platform release asset, not a Composer package.

Parameters
$path : string
Return values
self|null

registrationFinish()

Completes an enrolment, CONSUMING `$state` whether it succeeds or fails.

public registrationFinish(mixed $state, string $password, string $registrationResponse, mixed $ksf) : string|null

The returned string is copied out and the Rust allocation freed before it is handed back; a null means the library refused.

Parameters
$state : mixed
$password : string
$registrationResponse : string
$ksf : mixed
Return values
string|null —

the hex RegistrationRecord, or null when refused

registrationFree()

Releases enrolment state that was never finished.

public registrationFree(mixed $state) : void
Parameters
$state : mixed

registrationStart()

Begins an enrolment, returning the state handle and the hex `RegistrationRequest`.

public registrationStart(string $password) : array{0: mixed, 1: string}|null
Parameters
$password : string
Return values
array{0: mixed, 1: string}|null —

the state handle and the hex RegistrationRequest, or null when refused

On this page

Search results