SensioLabs Security Check VS PHPSecLib

Local PHP Security Checker: PHP security vulnerabilities checker

We use snyk, but I have found symfonys security checker to be the quickest to catch vulns: https://github.com/fabpot/local-php-security-checker

Yeah, see github https://github.com/FriendsOfPHP/security-advisories/issues/587. The source is also removed from https://github.com/robotchanchan/

I recommend using PHPSecLib which has a powerful SSH library that is far more versatile than the official PHP SSH extension.

I did a lot of research on how to perform this validation. In many blogs, I saw many people recommending using native functions like openssl_verify, openssl_get_publickey, or openssl_pkey_get_details, but unfortunately, they didn't work for what I needed (Remember, an SSH key is different from an SSL key, so these functions won't work). In other forums, I saw people suggesting using the package https://phpseclib.com/. But think about it, why install a package when you're only going to use one class and one of its methods?

ports: phpseclib 3.0.19[1]

PHP libraries that provide support for asymmetric encryption OpenSSL: https://www.php.net/manual/en/book.openssl.php phpseclib: https://github.com/phpseclib/phpseclib Sodium: https://www.php.net/manual/en/book.sodium.php

And also, another strategy is to look through the Unit tests on the project, so you can see how it's actually used. for example: https://github.com/phpseclib/phpseclib/blob/master/tests/Unit/Crypt/RSA/ModeTest.php

You can also use phpseclib (PHP Secure Communications Library), which has all kinds of security-related functions, including functions for symmetric encryption. It uses a pure PHP implementation, so you don't need libraries like openssl or libsodium, but they will be used when installed (for speed).