public static function unseal(
        string $ciphertext,
        EncryptionSecretKey $privateKey,
        $encoding = Halite::ENCODE_BASE64URLSAFE
    ): HiddenString {
        $decoder = Halite::chooseEncoder($encoding, true);
        if ($decoder) {
            // We were given hex data:
            try {
                /** @var string $ciphertext */
                $ciphertext = $decoder($ciphertext);
            } catch (\RangeException $ex) {
                throw new InvalidMessage(
                    'Invalid character encoding'
                );
            }
        }

        // Get a box keypair (needed by crypto_box_seal_open)
        $secret_key = $privateKey->getRawKeyMaterial();
        $public_key = \sodium_crypto_box_publickey_from_secretkey($secret_key);
        $key_pair = \sodium_crypto_box_keypair_from_secretkey_and_publickey(
            $secret_key,
            $public_key
        );
        
        // Wipe these immediately:
        \sodium_memzero($secret_key);
        \sodium_memzero($public_key);
        
        // Now let's open that sealed box
        $message = \sodium_crypto_box_seal_open(
            $ciphertext,
            $key_pair
        );

        // Always memzero after retrieving a value
        \sodium_memzero($key_pair);
        if (!\is_string($message)) {
            // @codeCoverageIgnoreStart
            throw new InvalidKey(
                'Incorrect secret key for this sealed message'
            );
            // @codeCoverageIgnoreEnd
        }

        // We have our encrypted message here
        return new HiddenString($message);
    }
public static function unseal(
        string $ciphertext,
        EncryptionSecretKey $privateKey,
        $encoding = Halite::ENCODE_BASE64URLSAFE
    ): HiddenString {
        $decoder = Halite::chooseEncoder($encoding, true);
        if ($decoder) {
            // We were given hex data:
            try {
                /** @var string $ciphertext */
                $ciphertext = $decoder($ciphertext);
            } catch (\RangeException $ex) {
                throw new InvalidMessage(
                    'Invalid character encoding'
                );
            }
        }

        // Get a box keypair (needed by crypto_box_seal_open)
        $secret_key = $privateKey->getRawKeyMaterial();
        $public_key = \sodium_crypto_box_publickey_from_secretkey($secret_key);
        $key_pair = \sodium_crypto_box_keypair_from_secretkey_and_publickey(
            $secret_key,
            $public_key
        );
        
        // Wipe these immediately:
        \sodium_memzero($secret_key);
        \sodium_memzero($public_key);
        
        // Now let's open that sealed box
        $message = \sodium_crypto_box_seal_open(
            $ciphertext,
            $key_pair
        );

        // Always memzero after retrieving a value
        \sodium_memzero($key_pair);
        if (!\is_string($message)) {
            // @codeCoverageIgnoreStart
            throw new InvalidKey(
                'Incorrect secret key for this sealed message'
            );
            // @codeCoverageIgnoreEnd
        }

        // We have our encrypted message here
        return new HiddenString($message);
    }
public static function unseal ( string $ ciphertext , EncryptionSecretKey $ privateKey , $ encoding = Halite :: ENCODE_BASE64URLSAFE ) : HiddenString { $ decoder = Halite :: chooseEncoder ( $ encoding , true ) ; if ( $ decoder ) { // We were given hex data: try { /** @var string $ciphertext */ $ ciphertext = $ decoder ( $ ciphertext ) ; } catch ( \ RangeException $ ex ) { throw new InvalidMessage ( 'Invalid character encoding' ) ; } } // Get a box keypair (needed by crypto_box_seal_open) $ secret_key = $ privateKey -> getRawKeyMaterial ( ) ; $ public_key = \ sodium_crypto_box_publickey_from_secretkey ( $ secret_key ) ; $ key_pair = \ sodium_crypto_box_keypair_from_secretkey_and_publickey ( $ secret_key , $ public_key ) ; // Wipe these immediately: \ sodium_memzero ( $ secret_key ) ; \ sodium_memzero ( $ public_key ) ; // Now let's open that sealed box $ message = \ sodium_crypto_box_seal_open ( $ ciphertext , $ key_pair ) ; // Always memzero after retrieving a value \ sodium_memzero ( $ key_pair ) ; if ( ! \ is_string ( $ message ) ) { // @codeCoverageIgnoreStart throw new InvalidKey ( 'Incorrect secret key for this sealed message' ) ; // @codeCoverageIgnoreEnd } // We have our encrypted message here return new HiddenString ( $ message ) ; }
Decrypt a sealed message with our private key

@param string $ciphertext              Encrypted message
@param EncryptionSecretKey $privateKey Private decryption key
@param mixed $encoding                 Which encoding scheme to use?
@return HiddenString

@throws InvalidKey
@throws InvalidMessage
@throws InvalidType
@throws \TypeError
Decrypt a sealed message with our private key