xmlseclibs

xmlseclibs is a PHP library for working with XML Encryption and XML Digital Signatures. It implements the W3C XMLDSig and XML Encryption standards, letting PHP applications sign, verify, encrypt, and decrypt XML documents and fragments using a range of algorithms and key formats.

Widely used as the cryptographic backbone of SAML single sign-on and WS-Security implementations, xmlseclibs exposes classes for building and validating signatures, managing security keys, and performing canonicalization. It builds on phpseclib for the underlying cryptographic operations and supports modern algorithms including RSA-SHA and AES-GCM.

What You Get

• XMLSecurityDSig for creating and verifying XML digital signatures (XMLDSig)
• XMLSecEnc for encrypting and decrypting XML elements and content
• XMLSecurityKey for loading and managing keys across multiple algorithms
• Support for canonicalization (C14N) and standard signature/digest algorithms
• Modern algorithm support including RSA-SHA family and AES-GCM

Common Use Cases

• Signing and verifying SAML assertions and responses in single sign-on flows
• Implementing WS-Security message signing for SOAP web services
• Encrypting sensitive XML elements before transmission or storage
• Validating the integrity and authenticity of received signed XML documents

Under The Hood

Architecture - The library is intentionally compact: three core classes in src/ carry the surface. XMLSecurityDSig builds and validates the ds:Signature element tree over a DOMDocument, XMLSecEnc handles EncryptedData/EncryptedKey structures, and XMLSecurityKey abstracts key material and algorithm selection. A Utils/XPath helper supports node querying and canonicalization, so the classes operate directly on the DOM rather than through an intermediate model.

Tech Stack - Pure PHP targeting 8.0+, distributed as robrichards/xmlseclibs under BSD-3-Clause and PSR-4 autoloading. It depends on phpseclib/phpseclib 3.x for cryptographic primitives and optionally uses ext-openssl to accelerate operations. PHPUnit drives the test suite.

Code Quality - Despite the security-critical domain, the code stays small and readable, with a substantial tests/ directory (58 fixtures and cases) covering signature and encryption round-trips. Algorithm handling is centralized in XMLSecurityKey, reducing duplication, and the project has a long maintenance history reflected in its CHANGELOG.

API Design - The API is procedural and DOM-oriented: you instantiate XMLSecurityDSig, set canonicalization and signature methods, add references, and load a key before signing or verifying. This mirrors the XML Security specs closely, which experienced integrators appreciate but does require understanding of XMLDSig concepts, giving it a moderate learning curve.