pps-php

Policy Binding

Policy binding allows the server to require specific security properties for a given operation.

---

Policy Object

use Pps\Payload\PolicyObject;

$policy = new PolicyObject();
$policy->minTrustDigits = 8;
$policy->requireBiometric = true;
$policy->requireSecureEnclave = true;
$policy->threshold = 2;
$policy->maxAmountMinor = 10000000;
$policy->requireProximity = true;
$policy->requireAmountMark = true;

The policy hash is:

pol = SHA256(CBOR(policy_object))

---

Client Binding

$pulse = $client
    ->rpId('example.com')
    ->nonce($nonceB64u)
    ->policy($policy)
    ->amountMinor(2500067)
    ->createPulse();

---

Server Verification

$result = $handler->verify(
    pulseToken: $pulse['token'],
    rpId: 'example.com',
    nonceB64u: $nonceB64u,
    amountMinor: 2500067,
    policy: $policy
);

If the policy hash does not match, verification fails with:

bad_policy

---

Example Policies

Low-Risk Login

$policy = new PolicyObject();
$policy->minTrustDigits = 8;
$policy->allowOffline = true;

Standard Login

$policy = new PolicyObject();
$policy->minTrustDigits = 8;
$policy->requireBiometric = true;
$policy->requireSecureEnclave = true;

High-Value Transfer

$policy = new PolicyObject();
$policy->minTrustDigits = 8;
$policy->requireBiometric = true;
$policy->requireSecureEnclave = true;
$policy->threshold = 2;
$policy->maxAmountMinor = 10000000;
$policy->requireAmountMark = true;

---

Downgrade Protection

The server must reject weaker policies than required.

If the expected policy hash is:

A

and the Pulse contains:

B

the server must reject the Pulse.

This site is open source. Improve this page.