Encryption

Encryption Overview

PurePHPEncryptor uses industry-standard cryptographic algorithms to protect your source code. There's no "security through obscurity"—the security comes from well-vetted algorithms and proper key management.

How Encryption Works

1. Key Generation

When you generate a license, an ECDH key pair is created:

License Generation
├── Generate ECDH P-256 key pair
│   ├── Private key (stored in license file)
│   └── Public key (embedded in encrypted files)
└── Sign license with ECDSA P-256

2. File Encryption

Each PHP file is encrypted with a unique key derived from the license:

For each PHP file:
├── Derive file-specific key using HKDF
│   └── Input: shared secret + file path + salt
├── Compress source code (optional, with zlib)
├── Encrypt with AES-256-GCM
│   ├── 256-bit key
│   ├── 96-bit random nonce
│   └── 128-bit authentication tag
└── Encode as base64 and wrap in PHP loader

3. Runtime Decryption

When an encrypted file is executed, the runtime:

Runtime Decryption
├── Load and validate license file
│   ├── Verify ECDSA signature
│   ├── Check expiration date
│   └── Validate hardware constraints
├── Perform ECDH key agreement
├── Derive file-specific key
├── Decrypt with AES-256-GCM
│   └── Verify authentication tag (tamper detection)
├── Decompress if needed
└── Execute decrypted PHP code in memory

AES-256-GCM

AES-256-GCM (Galois/Counter Mode) is an authenticated encryption algorithm that provides both confidentiality and integrity:

• 256-bit key: The largest key size for AES, providing maximum security
• Authenticated: Detects any tampering with the ciphertext
• Fast: Hardware-accelerated on modern CPUs (AES-NI)
• Standard: Used by TLS 1.3, HTTPS, and government systems

Tamper Protection

The authentication tag in AES-GCM ensures that any modification to the encrypted data is detected:

• Changing even one byte of the ciphertext invalidates the tag
• Decryption fails immediately on tamper detection
• No information is leaked about why decryption failed

This means attackers cannot:

• Modify encrypted code to bypass license checks
• Inject malicious code into encrypted files
• Partially decrypt or corrupt files

The Runtime

The runtime is a small PHP file (ppe-runtime.php) that handles license validation and decryption. It's automatically bundled with your encrypted files.

Runtime Features

• Pure PHP: Uses only standard PHP functions (OpenSSL, hash, json)
• Memory-only decryption: Decrypted code is never written to disk
• Automatic cleanup: Sensitive variables are cleared after use
• Silent failures: Errors don't reveal protection details

Runtime Files

After encryption, your output directory contains:

dist/
├── ppe-runtime.php      # The decryption runtime
├── license.ppe          # Your license file (copy manually)
├── index.php            # Encrypted entry point
├── src/
│   ├── Controller.php   # Encrypted
│   ├── Model.php        # Encrypted
│   └── ...
└── vendor/              # Third-party code (not encrypted by default)

How the Runtime Loads

Each encrypted file includes a small loader that bootstraps the runtime:

<?php /* PPE:AES256GCM:v1 */
require_once __DIR__.'/ppe-runtime.php';
__ppe_exec('base64-encoded-encrypted-data...');

The __ppe_exec() function:

1. Locates and validates the license file
2. Derives the decryption key
3. Decrypts the base64-encoded data
4. Executes the decrypted PHP code using eval()
5. Clears sensitive variables from memory

Performance Considerations

Decryption adds a small overhead to each file load. In practice, this is negligible:

Security Considerations

What PurePHPEncryptor Protects Against

• Casual inspection of source files
• Automated code scraping tools
• Unauthorized redistribution of your application
• License file tampering
• Encrypted file modification

Limitations

Like all software protection, PurePHPEncryptor is not unbreakable:

• A determined attacker with a valid license could dump decrypted code from memory
• The protection is only as strong as the server security
• Root access to the server allows observation of decrypted code