sodium_crypto_sign_open checks and opens a sealed, signed or authenticated ciphertext; the result depends on this function family.
The examples explain the data format, expected results and the difference between this API and nearby cryptographic operations.
What It Does
The operation is intended for: sodium_crypto_sign_open checks and opens a sealed, signed or authenticated ciphertext; the result depends on this function family.
The sodium extension must be enabled.
Syntax and Return Value
sodium_crypto_sign_open(string $signed_message, string $public_key): string|false| Parameter | Purpose |
|---|---|
| $signed_message (string) | Use the PHP signature above to determine the exact expected input type; validate untrusted inputs before calling. |
| $public_key (string) | A public key that belongs to the intended, verified peer. |
The declared return type is shown above. Errors can include false results or exceptions depending on this API: Secret signing keys must stay private; signatures authenticate bytes but not the signer identity unless the public key is trusted.
Example 1: Basic Operation
Ed25519 signing authenticates data, but does not conceal it; public-key trust must be established separately.
<?php
$message = "Account update";
$pair = sodium_crypto_sign_keypair();
$secret = sodium_crypto_sign_secretkey($pair);
$public = sodium_crypto_sign_publickey($pair);
$signed = sodium_crypto_sign($message, $secret);
var_dump(sodium_crypto_sign_open($signed, $public) === $message);Example 2: A Different Use Case
Ed25519 signing authenticates data, but does not conceal it; public-key trust must be established separately.
<?php
// Check the alternative case.
$message = "New order: 42";
$pair = sodium_crypto_sign_keypair();
$secret = sodium_crypto_sign_secretkey($pair);
$public = sodium_crypto_sign_publickey($pair);
$signed = sodium_crypto_sign($message, $secret);
var_dump(sodium_crypto_sign_open($signed, $public) === $message);Practical Example: Checking the Result
Ed25519 signing authenticates data, but does not conceal it; public-key trust must be established separately.
<?php
// Verify the expected behavior before using results.
$message = "Export completed";
$pair = sodium_crypto_sign_keypair();
$secret = sodium_crypto_sign_secretkey($pair);
$public = sodium_crypto_sign_publickey($pair);
$signed = sodium_crypto_sign($message, $secret);
var_dump(sodium_crypto_sign_open($signed, $public) === $message);Important Behavior and Edge Cases
Secret signing keys must stay private; signatures authenticate bytes but not the signer identity unless the public key is trusted.
Signatures must be verified against an authentic public key. A valid signature is not proof that a public key belongs to a particular identity.
Comparison with Related Functions
| Approach | Key distinction |
|---|---|
| sodium_crypto_sign_open | sodium_crypto_sign_open checks and opens a sealed, signed or authenticated ciphertext; the result depends on this function family. |
| Related technique | sodium_crypto_auth authenticates between holders of one shared symmetric key. |
Common Beginner Mistakes
| Mistake | Correct approach |
|---|---|
| Confusing this operation with a neighboring cryptographic or security mechanism | sodium_crypto_auth authenticates between holders of one shared symmetric key. |
| Ignoring a security prerequisite or failure case | Secret signing keys must stay private; signatures authenticate bytes but not the signer identity unless the public key is trusted. |
Key Takeaways
- sodium_crypto_sign_open checks and opens a sealed, signed or authenticated ciphertext; the result depends on this function family.
- Secret signing keys must stay private; signatures authenticate bytes but not the signer identity unless the public key is trusted.
- sodium_crypto_auth authenticates between holders of one shared symmetric key.
Apply this behavior to a real application only after confirming the required extension, configuration and failure handling on the deployment runtime.