Context binding binds a Pulse to session, transaction, or environmental data.
use Pps\Payload\ContextObject;
$context = new ContextObject();
$context->sessionId = $sessionId;
$context->txHash = $txHash;
$context->bleHash = $bleHash;
$context->acousticHash = $acousticHash;
$context->deviceIntegrityHash = $deviceIntegrityHash;
The context hash is:
ctx = SHA256(CBOR(context_object))
| Field | Description |
|---|---|
sessionId |
Session identifier |
txHash |
Transaction hash |
bleHash |
BLE proximity beacon hash |
acousticHash |
Acoustic nonce hash |
ipHash |
Privacy-preserving IP hash |
uaHash |
User agent hash |
deviceIntegrityHash |
Device integrity measurement |
customHash |
Application-specific hash |
use Pps\Crypto\Random;
$context = new ContextObject();
$context->sessionId = Random::bytes(16);
$context->bleHash = hash('sha256', $bleBeaconPayload, true);
Client:
$pulse = $client
->rpId('example.com')
->nonce($nonceB64u)
->context($context)
->createPulse();
Server:
$result = $handler->verify(
pulseToken: $pulse['token'],
rpId: 'example.com',
nonceB64u: $nonceB64u,
context: $context
);
BLE proximity example:
1. Laptop broadcasts a temporary BLE beacon.
2. Phone receives the beacon.
3. Phone hashes the beacon payload.
4. Phone includes the hash in the context object.
5. Server verifies the expected hash.
This increases relay attack cost but is not absolute proof of physical presence.
Avoid placing raw personal data in context fields.
Prefer hashed values:
$ipHash = hash('sha256', $ip . $dailySalt, true);