Using Sodium for Authenticated Encryption

Use libsodium AEAD to keep confidential data encrypted and detect tampering. The examples separate the essential operation from the conditions a production implementation must enforce.

What It Does

Use libsodium AEAD to keep confidential data encrypted and detect tampering.

Prerequisites

Use a dedicated development environment with test accounts and records. Separate authorization, validation and error handling from response formatting; never copy demonstration-only secrets into production.

Example 1: Core Behavior

The first example isolates the core operation so its result is easy to understand.

<?php
$key = sodium_crypto_aead_xchacha20poly1305_ietf_keygen();
$nonce = random_bytes(SODIUM_CRYPTO_AEAD_XCHACHA20POLY1305_IETF_NPUBBYTES);
$cipher = sodium_crypto_aead_xchacha20poly1305_ietf_encrypt('secret', 'record:1', $nonce, $key);
echo sodium_crypto_aead_xchacha20poly1305_ietf_decrypt($cipher, 'record:1', $nonce, $key);

Example 2: Alternative or Failure Case

The second example demonstrates an alternative outcome, rule or failure condition.

<?php
$key = sodium_crypto_aead_xchacha20poly1305_ietf_keygen();
$nonce = random_bytes(SODIUM_CRYPTO_AEAD_XCHACHA20POLY1305_IETF_NPUBBYTES);
$cipher = sodium_crypto_aead_xchacha20poly1305_ietf_encrypt('private', 'tenant:4', $nonce, $key);
var_export(sodium_crypto_aead_xchacha20poly1305_ietf_decrypt($cipher, 'tenant:5', $nonce, $key));

Practical Example: Applying the Rule

The practical example shows how to carry the same constraint into application code.

<?php
$key = sodium_crypto_secretbox_keygen();
$nonce = random_bytes(SODIUM_CRYPTO_SECRETBOX_NONCEBYTES);
$box = sodium_crypto_secretbox('user-note', $nonce, $key);
$opened = sodium_crypto_secretbox_open($box, $nonce, $key);
echo $opened === false ? 'Invalid' : $opened;

Important Behavior and Edge Cases

Generate a unique nonce for each message under the same key and protect key material separately.

Comparison with Related Functions or Patterns

Common Beginner Mistakes

Key Takeaways

• Use libsodium AEAD to keep confidential data encrypted and detect tampering.
• Generate a unique nonce for each message under the same key and protect key material separately.
• A MAC authenticates data but does not hide its content.

Select this API or pattern based on its documented behavior and the trust boundaries in your own application, and test all external integrations against their actual deployments.