sodium_crypto_box_seal_open checks and opens a sealed, signed or authenticated ciphertext; the result depends on this function family.
The examples explain the data format, expected results and the difference between this API and nearby cryptographic operations.
What It Does
The operation is intended for: sodium_crypto_box_seal_open checks and opens a sealed, signed or authenticated ciphertext; the result depends on this function family.
The sodium extension must be enabled.
Syntax and Return Value
sodium_crypto_box_seal_open(string $ciphertext, string $key_pair): string|false| Parameter | Purpose |
|---|---|
| $ciphertext (string) | The encrypted bytes, including any authentication information required by the API. |
| $key_pair (string) | Use the PHP signature above to determine the exact expected input type; validate untrusted inputs before calling. |
The declared return type is shown above. Errors can include false results or exceptions depending on this API: Keep secret keys private; the nonce must never repeat with the same key pair. A sealed box does not authenticate the sender.
Example 1: Basic Operation
The sender and receiver must use matching public and secret key material, not share private keys.
<?php
$message = "Account update";
$sender = sodium_crypto_box_keypair();
$receiver = sodium_crypto_box_keypair();
$sealed = sodium_crypto_box_seal($message, sodium_crypto_box_publickey($receiver));
var_dump(sodium_crypto_box_seal_open($sealed, $receiver) === $message);Example 2: A Different Use Case
The sender and receiver must use matching public and secret key material, not share private keys.
<?php
// Check the alternative case.
$message = "New order: 42";
$sender = sodium_crypto_box_keypair();
$receiver = sodium_crypto_box_keypair();
$sealed = sodium_crypto_box_seal($message, sodium_crypto_box_publickey($receiver));
var_dump(sodium_crypto_box_seal_open($sealed, $receiver) === $message);Practical Example: Checking the Result
The sender and receiver must use matching public and secret key material, not share private keys.
<?php
// Verify the expected behavior before using results.
$message = "Export completed";
$sender = sodium_crypto_box_keypair();
$receiver = sodium_crypto_box_keypair();
$sealed = sodium_crypto_box_seal($message, sodium_crypto_box_publickey($receiver));
var_dump(sodium_crypto_box_seal_open($sealed, $receiver) === $message);Important Behavior and Edge Cases
Keep secret keys private; the nonce must never repeat with the same key pair. A sealed box does not authenticate the sender.
The sender must use the receiver public key and its own secret key, and the receiver needs a complementary pair. Sealed boxes intentionally do not authenticate the sender.
Comparison with Related Functions
| Approach | Key distinction |
|---|---|
| sodium_crypto_box_seal_open | sodium_crypto_box_seal_open checks and opens a sealed, signed or authenticated ciphertext; the result depends on this function family. |
| Related technique | secretbox works with a single shared symmetric key rather than a public/secret key pair. |
Common Beginner Mistakes
| Mistake | Correct approach |
|---|---|
| Confusing this operation with a neighboring cryptographic or security mechanism | secretbox works with a single shared symmetric key rather than a public/secret key pair. |
| Ignoring a security prerequisite or failure case | Keep secret keys private; the nonce must never repeat with the same key pair. A sealed box does not authenticate the sender. |
Key Takeaways
- sodium_crypto_box_seal_open checks and opens a sealed, signed or authenticated ciphertext; the result depends on this function family.
- Keep secret keys private; the nonce must never repeat with the same key pair. A sealed box does not authenticate the sender.
- secretbox works with a single shared symmetric key rather than a public/secret key pair.
Apply this behavior to a real application only after confirming the required extension, configuration and failure handling on the deployment runtime.