# M7 PHP Crypto

M7 PHP Crypto is a compiled PHP extension for importing and generating keys,
signing and verifying bytes, exporting PEM, and encrypting small secrets with
RSA-OAEP-256. Its `M7\Crypto\Key` class calls the separate M7 C Crypto shared
library. The extension binary is `m7crypto.so`.

The current source version is **0.3.0, a verified development candidate**.
Final release and public download verification are pending. See
[release status and integrity](https://m7.org/docs/sdk/m7-php-crypto/releases.md) before selecting an artifact.

## Integrate native cryptography in PHP

- [API, examples, object lifetime and errors](https://m7.org/docs/sdk/m7-php-crypto/integration/README.md)
- [Source installation, PHP compatibility and troubleshooting](https://m7.org/docs/sdk/m7-php-crypto/integration/installation.md)
- [AlmaLinux: build, test, install and activate the C/PHP pair](https://m7.org/docs/sdk/m7-php-crypto/integration/almalinux.md)
- [Release status, artifact format and changes](https://m7.org/docs/sdk/m7-php-crypto/releases.md)

The initial validated target is **PHP 8.4 NTS**, with M7 C Crypto 0.3.0 and a
compatible OpenSSL runtime. The headers require PHP 8.4+; other PHP versions and
ZTS builds need separate validation. Broader PHP support is later work.
An extension compiled for one PHP API, thread-safety mode, OS or CPU must not be
assumed portable to another.

This component is optional for ordinary M7 Identity SDK installation. The SDK's
PHP baseline does not imply that this native extension supports PHP 8.1. Native
feature selection brings the extension and C library requirements; their release
does not change the ordinary SDK release or require its users to install them.

The extension provides cryptographic primitives, not OIDC discovery, token
acquisition, JWT claim validation, authorization or key custody. It calls the
C library directly without a runtime FFI or subprocess dependency.
`m7crypto.stub.php` is an API declaration for build tools and IDEs, not a PHP
implementation to include at runtime.

The package uses the MTL-10 license; read `LICENSE.md` in the reviewed bundle
before distribution. Report security issues privately to `security@m7.org`,
without sending production keys or tokens.