PHPSecLib VS hyperscan

I recommend using PHPSecLib which has a powerful SSH library that is far more versatile than the official PHP SSH extension.

I did a lot of research on how to perform this validation. In many blogs, I saw many people recommending using native functions like openssl_verify, openssl_get_publickey, or openssl_pkey_get_details, but unfortunately, they didn't work for what I needed (Remember, an SSH key is different from an SSL key, so these functions won't work). In other forums, I saw people suggesting using the package https://phpseclib.com/. But think about it, why install a package when you're only going to use one class and one of its methods?

ports: phpseclib 3.0.19[1]

PHP libraries that provide support for asymmetric encryption OpenSSL: https://www.php.net/manual/en/book.openssl.php phpseclib: https://github.com/phpseclib/phpseclib Sodium: https://www.php.net/manual/en/book.sodium.php

And also, another strategy is to look through the Unit tests on the project, so you can see how it's actually used. for example: https://github.com/phpseclib/phpseclib/blob/master/tests/Unit/Crypt/RSA/ModeTest.php

You can also use phpseclib (PHP Secure Communications Library), which has all kinds of security-related functions, including functions for symmetric encryption. It uses a pure PHP implementation, so you don't need libraries like openssl or libsodium, but they will be used when installed (for speed).

Maybe some other PCRE-compatible implementation offers streaming. For instance, https://www.intel.com/content/www/us/en/developer/articles/t... says it has this feature, but of course given who it's from it may be tied to a single brand of CPU.

github seems to be https://github.com/intel/hyperscan

I think of WAFs as an extra safety net. Defense in depth.

The author complained about the performance cost of WAFs in general, but not all WAFs have be structured like ModSecurity. They could for example be based on something like https://github.com/intel/hyperscan and perf is at a very different level.

Another example of old timey Unix code just breaking things in minor point releases. See https://abi-laboratory.pro/index.php?view=changelog&l=glibc&... and https://github.com/intel/hyperscan/issues/359.

It’s a bespoke scanning setup designed to deal with GitHub’s scale. Under the hood it’s using Intel’s hyperscan as the regex engine.

https://github.com/intel/hyperscan

Hyperscan is an Intel regular expression library.

We are using hyperscan [3] instead of grepping byte sequences with Python, which is orders of magnitudes faster. It can also handle 4Gb+ files because of this which binwalk cannot.

It's used for a year now in production and it's way more precise and faster than binwalk. We are getting less false-positives too, and even if unblob fails to extract everything, we still get meaningful information out of firmwares, where binwalk just failed with no output previously.

[1]: https://github.com/onekey-sec/unblob/blob/main/unblob/handle...

[2]: https://github.com/onekey-sec/unblob/blob/main/unblob/proces...

[3]: https://github.com/intel/hyperscan