sodium_crypto_sign attaches an Ed25519 signature to a message.
The examples explain the data format, expected results and the difference between this API and nearby cryptographic operations.
What It Does
The operation is intended for: sodium_crypto_sign attaches an Ed25519 signature to a message.
The sodium extension must be enabled.
Syntax and Return Value
sodium_crypto_sign(string $message, string $secret_key): string| Parameter | Purpose |
|---|---|
| $message (string) | The plaintext or input message bytes; content is not automatically character-normalized. |
| $secret_key (string) | A private secret key or cryptographic keypair, as required by the function. |
The declared return type is shown above. Errors can include false results or exceptions depending on this API: Secret signing keys must stay private; signatures authenticate bytes but not the signer identity unless the public key is trusted.
Example 1: Basic Operation
Ed25519 signing authenticates data, but does not conceal it; public-key trust must be established separately.
<?php
$message = "Account update";
$pair = sodium_crypto_sign_keypair();
$secret = sodium_crypto_sign_secretkey($pair);
$public = sodium_crypto_sign_publickey($pair);
$signed = sodium_crypto_sign($message, $secret);
echo strlen($signed);Example 2: A Different Use Case
Ed25519 signing authenticates data, but does not conceal it; public-key trust must be established separately.
<?php
// Check the alternative case.
$message = "New order: 42";
$pair = sodium_crypto_sign_keypair();
$secret = sodium_crypto_sign_secretkey($pair);
$public = sodium_crypto_sign_publickey($pair);
$signed = sodium_crypto_sign($message, $secret);
echo strlen($signed);Practical Example: Checking the Result
Ed25519 signing authenticates data, but does not conceal it; public-key trust must be established separately.
<?php
// Verify the expected behavior before using results.
$message = "Export completed";
$pair = sodium_crypto_sign_keypair();
$secret = sodium_crypto_sign_secretkey($pair);
$public = sodium_crypto_sign_publickey($pair);
$signed = sodium_crypto_sign($message, $secret);
echo strlen($signed);Important Behavior and Edge Cases
Secret signing keys must stay private; signatures authenticate bytes but not the signer identity unless the public key is trusted.
Secret signing keys must stay private; signatures authenticate bytes but not the signer identity unless the public key is trusted.
Comparison with Related Functions
| Approach | Key distinction |
|---|---|
| sodium_crypto_sign | sodium_crypto_sign attaches an Ed25519 signature to a message. |
| Related technique | sodium_crypto_auth authenticates between holders of one shared symmetric key. |
Common Beginner Mistakes
| Mistake | Correct approach |
|---|---|
| Confusing this operation with a neighboring cryptographic or security mechanism | sodium_crypto_auth authenticates between holders of one shared symmetric key. |
| Ignoring a security prerequisite or failure case | Secret signing keys must stay private; signatures authenticate bytes but not the signer identity unless the public key is trusted. |
Key Takeaways
- sodium_crypto_sign attaches an Ed25519 signature to a message.
- Secret signing keys must stay private; signatures authenticate bytes but not the signer identity unless the public key is trusted.
- sodium_crypto_auth authenticates between holders of one shared symmetric key.
Apply this behavior to a real application only after confirming the required extension, configuration and failure handling on the deployment runtime.