pps-php

Transaction Signing

PPS supports transaction signing with human-visible amount confirmation.

---

Transaction Object

use Pps\Payload\TransactionObject;

$transaction = new TransactionObject(
    action: 'withdraw',
    amountMinor: 2500067,
    currency: 'IRR',
    recipient: 'IR820540102680020817909002'
);

The transaction hash is:

tx_hash = SHA256(CBOR(transaction_object))

---

Context Binding

The transaction hash should be included in the context object.

use Pps\Payload\ContextObject;

$context = new ContextObject();
$context->sessionId = $sessionId;
$context->txHash = $transaction->hash();

---

AmountMark

The AmountMark is:

amount_minor mod 100

Example:

amount_minor = 2500067
AmountMark = 67

The Trust Code includes the AmountMark:

Trust Code = 49371867

The last two digits match the amount.

---

Client Example

use Pps\Client\AuthenticatorClient;

$client = new AuthenticatorClient($clientState);
$pulse = $client
    ->rpId('example.com')
    ->nonce($nonceB64u)
    ->context($context)
    ->amountMinor($transaction->amountMinor)
    ->createPulse();

---

Server Verification

use Pps\Server\AuthenticationHandler;

$handler = new AuthenticationHandler($storage);
$result = $handler->verify(
    pulseToken: $pulse['token'],
    rpId: 'example.com',
    nonceB64u: $nonceB64u,
    amountMinor: $transaction->amountMinor,
    context: $context,
    trustCode: $pulse['trust_code']
);

---

User Experience

Example confirmation screen:

+------------------------------------------+
| WITHDRAWAL CONFIRMATION                  |
+------------------------------------------+
| Amount:    2,500,067 IRR                 |
| To:        IR820540102680020817909002    |
| Code:      49371867                      |
+------------------------------------------+
| [Reject]                    [Approve]    |
+------------------------------------------+

The user checks that the last two digits of the Trust Code match the amount.

This site is open source. Improve this page.