zorin-authority-sdk-php

Zorin Authority SDK — PHP 0.4

Offline verification helpers for ZAUTH/1 and ZWEB/1.

Verifier::verifyWebAuthentication() verifies the project/origin/challenge/request transaction binding and the phone-signed ZOWNER/1 proof against the phone public key enrolled for the account.

Native USB biometric proofs

Zorin Trust 0.13 uses the signed owner-proof action web.authenticate.biometric for foreign native-USB login after BIOMETRIC_STRONG. Backends that require this assurance must enable the verifier’s biometric requirement instead of trusting a browser-supplied flag.

Backends can require the signed web.authenticate.biometric action with the require_biometric option. This verifies fresh biometric assurance from the phone proof instead of trusting browser metadata.

Request-id binding

Version 0.4 can require the exact server-issued request-id in addition to project, origin and challenge. Reference backends should always pass it to the verifier so a valid proof from another concurrent browser transaction cannot be substituted into the current request.

Source · MIT