sodium_crypto_box_seed_keypair constructs a public/secret keypair for the selected cryptographic scheme.
The examples explain the data format, expected results and the difference between this API and nearby cryptographic operations.
What It Does
The operation is intended for: sodium_crypto_box_seed_keypair constructs a public/secret keypair for the selected cryptographic scheme.
The sodium extension must be enabled.
Syntax and Return Value
sodium_crypto_box_seed_keypair(string $seed): string| Parameter | Purpose |
|---|---|
| $seed (string) | Use the PHP signature above to determine the exact expected input type; validate untrusted inputs before calling. |
The declared return type is shown above. Errors can include false results or exceptions depending on this API: Keep secret keys private; the nonce must never repeat with the same key pair. A sealed box does not authenticate the sender.
Example 1: Basic Operation
The sender and receiver must use matching public and secret key material, not share private keys.
<?php
$seed = random_bytes(SODIUM_CRYPTO_BOX_SEEDBYTES);
$keypair = sodium_crypto_box_seed_keypair($seed);
echo strlen($keypair);Example 2: A Different Use Case
Inspect only the public component or the encoded keypair size.
<?php
// Check the alternative case.
$seed = random_bytes(SODIUM_CRYPTO_BOX_SEEDBYTES);
$keypair = sodium_crypto_box_seed_keypair($seed);
var_dump(strlen($keypair) === SODIUM_CRYPTO_BOX_KEYPAIRBYTES);Practical Example: Checking the Result
Inspect only the public component or the encoded keypair size.
<?php
// Verify the expected behavior before using results.
$seed = random_bytes(SODIUM_CRYPTO_BOX_SEEDBYTES);
$keypair = sodium_crypto_box_seed_keypair($seed);
echo bin2hex(sodium_crypto_box_publickey($keypair));Important Behavior and Edge Cases
Keep secret keys private; the nonce must never repeat with the same key pair. A sealed box does not authenticate the sender.
The sender must use the receiver public key and its own secret key, and the receiver needs a complementary pair. Sealed boxes intentionally do not authenticate the sender.
Comparison with Related Functions
| Approach | Key distinction |
|---|---|
| sodium_crypto_box_seed_keypair | sodium_crypto_box_seed_keypair constructs a public/secret keypair for the selected cryptographic scheme. |
| Related technique | secretbox works with a single shared symmetric key rather than a public/secret key pair. |
Common Beginner Mistakes
| Mistake | Correct approach |
|---|---|
| Confusing this operation with a neighboring cryptographic or security mechanism | secretbox works with a single shared symmetric key rather than a public/secret key pair. |
| Ignoring a security prerequisite or failure case | Keep secret keys private; the nonce must never repeat with the same key pair. A sealed box does not authenticate the sender. |
Key Takeaways
- sodium_crypto_box_seed_keypair constructs a public/secret keypair for the selected cryptographic scheme.
- Keep secret keys private; the nonce must never repeat with the same key pair. A sealed box does not authenticate the sender.
- secretbox works with a single shared symmetric key rather than a public/secret key pair.
Apply this behavior to a real application only after confirming the required extension, configuration and failure handling on the deployment runtime.