PHP 怎么PHP 可验证凭证

wen PHP项目 2026-07-28 116

本文目录导读：

PHP 怎么PHP 可验证凭证

什么是可验证凭证
PHP 实现方案
推荐的 PHP 库
最佳实践

我来帮你梳理 PHP 实现可验证凭证（Verifiable Credentials, VC）的相关知识。

什么是可验证凭证

可验证凭证是 W3C 标准下的数字凭证，包含：

凭证元数据（颁发者、有效期等）
声明信息（具体的数据内容）
证明机制（数字签名等）

PHP 实现方案

1 使用 JSON-LD 签名

<?php
class VerifiableCredential {
    private array $credential;
    public function __construct() {
        $this->credential = [
            '@context' => [
                'https://www.w3.org/2018/credentials/v1',
                'https://www.w3.org/2018/credentials/examples/v1'
            ],
            'type' => ['VerifiableCredential', 'UniversityDegreeCredential'],
            'issuer' => '',
            'issuanceDate' => '',
            'credentialSubject' => []
        ];
    }
    public function setIssuer(string $did): self {
        $this->credential['issuer'] = $did;
        return $this;
    }
    public function setSubject(array $subject): self {
        $this->credential['credentialSubject'] = $subject;
        return $this;
    }
    public function addProof(string $type, array $proofData): self {
        $this->credential['proof'] = [
            'type' => $type,
            'created' => date('c'),
            'proofPurpose' => 'assertionMethod',
            ...$proofData
        ];
        return $this;
    }
    public function toJson(): string {
        return json_encode($this->credential, JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES);
    }
}
// 使用示例
$vc = new VerifiableCredential();
$vc->setIssuer('did:example:123456789abcdefghi')
   ->setSubject([
       'id' => 'did:example:123456789abcdefghij',
       'degree' => [
           'type' => 'BachelorDegree',
           'name' => 'Bachelor of Science'
       ]
   ])
   ->addProof('Ed25519Signature2018', [
       'verificationMethod' => 'did:example:123456789abcdefghi#keys-1',
       'jws' => 'eyJhbGciOiJFZERTQSJ9...'
   ]);
echo $vc->toJson();

2 使用 PHP-JWT 实现签名

<?php
require_once 'vendor/autoload.php';
use Firebase\JWT\JWT;
use Firebase\JWT\Key;
class VCJWT {
    private string $privateKey;
    private string $publicKey;
    public function __construct() {
        // 生成密钥对（实际项目使用安全的密钥管理）
        $this->generateKeyPair();
    }
    private function generateKeyPair(): void {
        $config = [
            'digest_alg' => 'sha256',
            'private_key_bits' => 2048,
            'private_key_type' => OPENSSL_KEYTYPE_RSA
        ];
        $res = openssl_pkey_new($config);
        openssl_pkey_export($res, $this->privateKey);
        $publicKey = openssl_pkey_get_details($res);
        $this->publicKey = $publicKey['key'];
    }
    public function createVC(array $claims): string {
        $payload = [
            'iss' => 'did:example:issuer',
            'sub' => 'did:example:subject',
            'iat' => time(),
            'exp' => time() + 3600,
            'vc' => [
                '@context' => ['https://www.w3.org/2018/credentials/v1'],
                'type' => ['VerifiableCredential'],
                'credentialSubject' => $claims
            ]
        ];
        return JWT::encode($payload, $this->privateKey, 'RS256');
    }
    public function verifyVC(string $jwt): object {
        try {
            $decoded = JWT::decode($jwt, new Key($this->publicKey, 'RS256'));
            return $decoded;
        } catch (\Exception $e) {
            throw new \Exception('Invalid credential: ' . $e->getMessage());
        }
    }
}
// 使用示例
$vcJwt = new VCJWT();
$credential = $vcJwt->createVC([
    'name' => '张三',
    'age' => 25,
    'degree' => 'Bachelor'
]);
echo "凭证内容:\n";
print_r($vcJwt->verifyVC($credential));

3 完整的 VC 管理类

<?php
class VCCredentialManager {
    private array $credentials = [];
    private array $revokedList = [];
    // 创建可验证凭证
    public function issueCredential(array $data): array {
        $vc = [
            'id' => $this->generateCredentialId(),
            '@context' => [
                'https://www.w3.org/2018/credentials/v1'
            ],
            'type' => ['VerifiableCredential'],
            'issuer' => $data['issuer'] ?? 'did:example:issuer',
            'issuanceDate' => date('c'),
            'credentialSubject' => [
                'id' => $data['subjectId'],
                'data' => $data['claims']
            ],
            'status' => [
                'id' => "https://verifier.example.com/status/" . $this->generateCredentialId(),
                'type' => 'CredentialStatusList2017'
            ]
        ];
        // 添加签名
        $vc['proof'] = $this->generateProof($vc);
        $this->credentials[$vc['id']] = $vc;
        return $vc;
    }
    // 验证凭证
    public function verifyCredential(array $vc): array {
        $result = [
            'valid' => true,
            'errors' => []
        ];
        // 1. 检查结构
        if (!$this->validateStructure($vc)) {
            $result['valid'] = false;
            $result['errors'][] = 'Invalid credential structure';
        }
        // 2. 检查是否被撤销
        if ($this->isRevoked($vc['id'] ?? '')) {
            $result['valid'] = false;
            $result['errors'][] = 'Credential has been revoked';
        }
        // 3. 验证签名
        if (!$this->verifyProof($vc)) {
            $result['valid'] = false;
            $result['errors'][] = 'Invalid proof';
        }
        // 4. 检查有效期
        if (isset($vc['expirationDate'])) {
            if (strtotime($vc['expirationDate']) < time()) {
                $result['valid'] = false;
                $result['errors'][] = 'Credential has expired';
            }
        }
        return $result;
    }
    // 撤销凭证
    public function revokeCredential(string $credentialId): bool {
        if (isset($this->credentials[$credentialId])) {
            $this->revokedList[] = $credentialId;
            $this->credentials[$credentialId]['status']['revoked'] = true;
            return true;
        }
        return false;
    }
    private function validateStructure(array $vc): bool {
        $required = ['@context', 'type', 'issuer', 'issuanceDate', 'credentialSubject'];
        foreach ($required as $field) {
            if (!isset($vc[$field])) {
                return false;
            }
        }
        return true;
    }
    private function generateProof(array $vc): array {
        // 简单的签名生成（实际生产环境使用更强的签名算法）
        $canonical = json_encode($vc, JSON_UNESCAPED_SLASHES);
        return [
            'type' => 'RsaSignature2018',
            'created' => date('c'),
            'verificationMethod' => 'did:example:issuer#keys-1',
            'proofPurpose' => 'assertionMethod',
            'jws' => base64_encode(hash('sha256', $canonical, true))
        ];
    }
    private function verifyProof(array $vc): bool {
        if (!isset($vc['proof'])) {
            return false;
        }
        $proof = $vc['proof'];
        $expectedHash = base64_encode(
            hash('sha256', json_encode($vc, JSON_UNESCAPED_SLASHES), true)
        );
        return $proof['jws'] === $expectedHash;
    }
    private function generateCredentialId(): string {
        return 'urn:uuid:' . bin2hex(random_bytes(16));
    }
    private function isRevoked(string $credentialId): bool {
        return in_array($credentialId, $this->revokedList);
    }
}
// 使用示例
$manager = new VCCredentialManager();
// 颁发凭证
$credential = $manager->issueCredential([
    'subjectId' => 'did:example:user123',
    'claims' => [
        'name' => '张三',
        'email' => 'zhangsan@example.com',
        'age' => 25
    ]
]);
echo "颁发的凭证:\n";
print_r($credential);
// 验证凭证
$result = $manager->verifyCredential($credential);
echo "\n验证结果:\n";
print_r($result);
// 撤销凭证
$manager->revokeCredential($credential['id']);
echo "\n撤销后验证:\n";
print_r($manager->verifyCredential($credential));

库名	说明	安装
php-json-ld	JSON-LD 处理	`composer require ml/json-ld`
firebase/php-jwt	JWT 生成和验证	`composer require firebase/php-jwt`
web3signer	DID 签名	`composer require consensys/web3signer`