pps-php

Offline Mode

Offline mode allows authentication without a live server nonce.

---

When to Use Offline Mode

Offline mode is useful for:

terminals without connectivity
IoT devices
field equipment
emergency access
unstable networks

---

Creating an Offline Pulse

use Pps\Client\AuthenticatorClient;

$client = new AuthenticatorClient($clientState);
$pulse = $client
    ->rpId('example.com')
    ->offline(true)
    ->createPulse();

No nonce is included.

---

Server Verification

use Pps\Server\AuthenticationHandler;

$handler = new AuthenticationHandler($storage);
$result = $handler->verifyOffline(
    pulseToken: $pulse['token'],
    rpId: 'example.com'
);

---

Security Trade-offs

Offline mode relies more heavily on:

monotonic counter
expiration
rate limiting
device security
risk policy

Online nonce-bound mode is preferred when possible.

---

Recommended Restrictions

For offline mode, servers should:

• apply stricter rate limits
• allow only low-risk operations
• require shorter expiration windows
• monitor anomalies
• reject suspicious counter jumps
• optionally require context binding

---

Rotation Certificates

Offline devices may rotate keys before the server observes previous Pulses.

Rotation certificates allow catch-up:

cert_0: pk_0 -> pk_1
cert_1: pk_1 -> pk_2
cert_2: pk_2 -> pk_3

The client includes pending certificates in the Pulse envelope.

This site is open source. Improve this page.