HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
paragonie
halite
PHP2015–2019
paragonie / halite

halite

High-level cryptography interface powered by libsodium

Security & PrivacyLibraries & SDKs
Explore on GitHubRead Hacker News discussions
2Distinct people
12Mentions
0Explicit recommenders
1.2KGitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

High-level cryptography interface powered by libsodium

GitHub

Where it is used

No documented product use has been verified yet.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

Mentioned in the same Hacker News threads. That is not proof they are substitutes.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 3:56:07 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year12 dated mentions

Observed mentions: 2015-11-15 20:24:57 UTC to 2019-07-08 17:34:32 UTC.

024682015-01-01 00:00:00 UTC to 2016-01-01 00:00:00 UTC (exclusive): 1 mentions; 1 submissions, 0 comments20152016-01-01 00:00:00 UTC to 2017-01-01 00:00:00 UTC (exclusive): 8 mentions; 2 submissions, 6 comments2017-01-01 00:00:00 UTC to 2018-01-01 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 comments20172018-01-01 00:00:00 UTC to 2019-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2019-01-01 00:00:00 UTC to 2020-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2019

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
20152015-01-01 00:00:00 UTC2016-01-01 00:00:00 UTC110
20162016-01-01 00:00:00 UTC2017-01-01 00:00:00 UTC826
20172017-01-01 00:00:00 UTC2018-01-01 00:00:00 UTC202
20182018-01-01 00:00:00 UTC2019-01-01 00:00:00 UTC000
20192019-01-01 00:00:00 UTC2020-01-01 00:00:00 UTC101

What Hacker News says

12 sources
CiPHPerCoder·Jul 8, 2019
TL;DR - you're mostly avoiding the admonishment by using libsodium There are still some dangerous things you can do (e.g. mismanage keys, reuse nonces). I wrote a library called Halite for PHP developers that wraps libsodium and makes it even harder to misuse. My philosophy was, "You shouldn't even need to know what a nonce is to use it securely." https://github.com/paragonie/halite From elsewhere in the thread, PyNaCl takes a similar approach. So how dangerous "just using libsodium" is, with respect to the "don't roll your own crypto" guidance, depends a little bit on which binding you're using. Also, a lot of tasks might require a specific protocol (PAKEs, VPN protocols, searchable encryption, etc.) that libsodium isn't suitable for.
In RSA is a fragile cryptosystem
CiPHPerCoder·May 30, 2017
I've tried it. I've failed at it. Halite is a libsodium wrapper for PHP projects that emphasizes ease-of-use and difficulty to misuse: https://github.com/paragonie/halite CMS Airship is a secure-by-default content management system (think WordPress, Drupal, Joomla, etc.): https://github.com/paragonie/airship Both projects are released under GPL but offer commercial licenses. In two years, I've only had one person ever inquire about a commercial license, and they backed out. One of the libraries I wrote has an installed base of (not counting WordPress) over 28 million, yet I rarely hear from its users: https://packagist.org/packages/paragonie/random_compat The barrier isn't legal or philosophical, it's that a lot of very useful open source software (especially libraries that developers interface with) are infrastructure rather than window
Read the rest
dressing, which is largely invisible to organizations. If you only develop window-dressing libraries, then the stuff 'patio11 has said here over the years might hold true. But if you're trying to build a more secure Internet by giving developers better tools, nobody wants to pay you for that.
In Ask HN: Why don't more open-source projects monetize?
CiPHPerCoder·Mar 19, 2017
> Is your homemade framework superior to Laravel? If so, how? Our cryptography is certainly superior to Laravel's. https://github.com/illuminate/encryption https://github.com/paragonie/halite Beyond that, nobody has paid me to look deeper and I haven't had any reason to. > There are vulnerabilities in there, I've seen enough code like that to almost guarantee you. If so, then anyone reading this thread who's aware of any vulnerabilities will be interested in: https://hackerone.com/paragonie
In How We Engineered CMS Airship to Be Simply Secure
CiPHPerCoder·Jul 23, 2016
I'm the person who published this advisory to oss-sec and a co-author of https://github.com/defuse/php-encryption I also wrote https://github.com/paragonie/halite which is a PHP library aims to make libsodium incredibly easy for PHP developers to get right. For systems that need asymmetric crypto and can't install libsodium, I also wrote https://github.com/paragonie/EasyRSA which side-steps a lot of the mistakes developers make. EasyRSA uses defuse for symmetric-key encryption, then encrypts the AES key with RSA. Writing secure cryptography isn't trivial. Assuming the three projects I just linked to are secure enough to use (all indications point to: they are), there's literally no reason to reinvent the wheel solely for Magento. Magento already uses Composer; they could just add them to their composer.json file and rewrite their routines
Read the rest
to use defuse + maybe EasyRSA if they have a use case for it. Zend\Crypt is also an acceptable choice, as long as you don't install the version with an RSA implementation vulnerable to padding oracle attacks. https://framework.zend.com/security/advisory/ZF2015-10
In Ruining the Magic of Magento's Encryption Library
CiPHPerCoder·May 2, 2016
SEEKING WORK: Application Security, Cryptography, Web Development REMOTE Only - (Located in Orlando, FL) What do WordPress, Joomla, Symfony, CodeIgniter, the Facebook SDK, CakePHP, Yii Framework, several implementations of RNCryptor in various programming languages, and Zend Framework's Cryptography Library all have in common? They've all benefited from my open source security research. Whether you're a startup looking to eliminate unnecessary risk while you focus on growth or a large business that needs to protect your assets, I can help. A brief sample of software I've written: * https://github.com/paragonie/halite - Halite: A PHP libsodium wrapper that emphasizes ease-of-use, secure defaults, and type-safety. * https://github.com/paragonie/random_compat Random_compat: Use the new PHP 7 CSPRNG functions in PHP 5 projects. * https://gith
Read the rest
ub.com/paragonie/constant_time_encoding - Constant-Time Encoding: A full implementation of RFC 4648 encoding/decoding functions that can be used to encode encryption keys for storage without leaking key material through cache-timing side-channels. * https://github.com/paragonie/csp-builder - CSP Builder: Build a Content-Security-Policy header for your website. Example config: https://github.com/paragonie/airship/blob/master/src/config/... Live demo: https://securityheaders.io/?q=https%3A%2F%2Fcspr.ng%2F * https://github.com/paragonie/airship - CMS Airship (beta software): A secure-by-default content management system and development framework that emphasizes secure package management and attempts to solve the Triangle of Secure Code Delivery: https://defuse.ca/triangle-of-secure-code-delivery.htm Other Technologies: * Excellent: PHP, Java, C#, Shell scripting * Experienced: HTML5/CSS3/JS, Node.js, C, C++, Python (with Django), Webserver configuration (Apache/nginx) * Currently learning: Ruby [on Rails] Feel free to contact me at security@paragonie.com if you're interested in working together.
In Ask HN: Freelancer? Seeking freelancer? (May 2016)

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.