01-registration.php

<?php

/**
 * PPS-PHP Example 01: Device Registration
 *
 * Demonstrates the complete registration flow:
 * 1. Server creates a registration challenge
 * 2. Client generates key pairs (normal + duress)
 * 3. Client signs the registration payload
 * 4. Server verifies and stores public keys
 *
 * Usage:
 *   php examples/01-registration.php
 */

declare(strict_types=1);

require_once __DIR__ . '/../vendor/autoload.php';

use Pps\Crypto\Base64Url;
use Pps\Key\KeyManager;
use Pps\Storage\InMemoryStorage;

echo "=== PPS-PHP Example 01: Device Registration ===\n\n";

// ---------------------------------------------------------------
// Step 1: Server creates a registration challenge
// ---------------------------------------------------------------

echo "Step 1: Server creates registration challenge\n";

$storage = new InMemoryStorage();
$rpId = 'example.com';

// Generate a random nonce for registration
$nonce = random_bytes(16);
$nonceB64u = Base64Url::encode($nonce);

echo "  RP ID: $rpId\n";
echo "  Nonce: $nonceB64u\n\n";

// ---------------------------------------------------------------
// Step 2: Client generates key pairs
// ---------------------------------------------------------------

echo "Step 2: Client generates key pairs\n";

// Create client state with normal and duress keys
$clientState = KeyManager::createClientState($rpId);

$kid = $clientState['kid'];
$normalSeed = Base64Url::decode($clientState['current_seed']);
$duressSeed = Base64Url::decode($clientState['duress_seed']);

$normalKey = KeyManager::keyPairFromSeed($normalSeed);
$duressKey = KeyManager::keyPairFromSeed($duressSeed);

echo "  KID: $kid\n";
echo "  Normal PK: " . $normalKey->publicKeyB64u() . "\n";
echo "  Duress PK: " . $duressKey->publicKeyB64u() . "\n\n";

// ---------------------------------------------------------------
// Step 3: Client signs the registration payload
// ---------------------------------------------------------------

echo "Step 3: Client signs registration payload\n";

use Pps\Payload\RegistrationPayload;
use Pps\Encoding\CborEncoder;
use Pps\Crypto\Ed25519;

$registrationPayload = new RegistrationPayload(
    rpId: $rpId,
    kid: Base64Url::decode($kid),
    pk: $normalKey->publicKey,
    userHandle: KeyManager::generateUserHandle(),
    nonce: $nonce,
    deviceName: 'My Phone',
    duressPk: $duressKey->publicKey
);

$message = $registrationPayload->encode();
$signature = Ed25519::sign($message, $normalKey->secretKey);
$duressSignature = Ed25519::sign($message, $duressKey->secretKey);

echo "  Message length: " . strlen($message) . " bytes\n";
echo "  Signature: " . Base64Url::encode($signature) . "\n";
echo "  Duress Signature: " . Base64Url::encode($duressSignature) . "\n\n";

// ---------------------------------------------------------------
// Step 4: Server verifies and stores public keys
// ---------------------------------------------------------------

echo "Step 4: Server verifies registration\n";

// Verify normal signature
$normalValid = Ed25519::verify($signature, $message, $normalKey->publicKey);
echo "  Normal signature valid: " . ($normalValid ? 'YES' : 'NO') . "\n";

// Verify duress signature
$duressValid = Ed25519::verify($duressSignature, $message, $duressKey->publicKey);
echo "  Duress signature valid: " . ($duressValid ? 'YES' : 'NO') . "\n";

if ($normalValid && $duressValid) {
    // Store device state
    $storage->saveDeviceState($kid, [
        'kid' => $kid,
        'current_pk' => $normalKey->publicKeyB64u(),
        'key_seq' => 0,
        'last_counter' => 0,
        'duress_pk' => $duressKey->publicKeyB64u(),
        'duress_key_seq' => 0,
        'duress_last_counter' => 0,
        'revoked' => false,
        'created_at' => time(),
    ]);

    echo "\n  Registration successful!\n";
    echo "  Device state stored.\n";
} else {
    echo "\n  Registration FAILED!\n";
    exit(1);
}

echo "\n=== Example 01 Complete ===\n";