Forem: BuildCoreWorks

Unleashing Native‑Speed Crypto in PHP: Introducing php‑secp256k1 & php‑keccak256

BuildCoreWorks — Sun, 19 Oct 2025 11:07:29 +0000

Have you ever tried to build a blockchain wallet or an NFT marketplace in PHP and felt like you were wearing lead boots? You’re not alone. PHP remains widely used in production and by a large share of working developers, but cryptographic workloads have traditionally been its kryptonite. Pure-PHP libraries for signing and hashing do the job, but when you need to sign or verify thousands of transactions per second, 100 milliseconds per call is the difference between “Hello, world!” and “Sorry, network timeout.” (The JetBrains Blog)

Why pure-PHP crypto hurts

Let’s quantify the pain. A widely used pure-PHP ECDSA (secp256k1) implementation benchmarks at ~90–136 ms per signature and ~100–135 ms per verification. At that rate, a node processing 1,000 TPS would spend ~2–4 minutes computing signatures/verifications for just one second’s workload—nowhere near real-time.

Enter `php-secp256k1`: native-speed ECDSA

Secp256k1 is the elliptic curve chosen by Bitcoin and Ethereum for digital signatures. Thanks to its structure, a tuned implementation can be ~30% faster than many other curves. Our php-secp256k1 wraps Bitcoin Core’s battle-tested libsecp256k1 C library as a PHP extension, so you get the same engine—just callable from PHP. In benchmarks, the extension delivers ~0.03–0.06 ms per signature and ~0.04–0.06 ms per verification. On an AMD Ryzen 7 3700X, that’s 0.030 ms/sign vs 89.6 ms in pure PHP, turning 100,000 signatures from hours into ~3–5 seconds. (Bitcoin Wiki)

<?php
// Sign a 32-byte message hash with a private key (64-char hex)
$signature = secp256k1_sign($hash, $privateKey);

// Verify a signature with the message hash and public key
$isValid = secp256k1_verify($hash, $signature, $publicKey);

// Recover the public key (Ethereum-style) from a signature and message hash
$publicKey = secp256k1_recover($hash, $signature);

Under the hood, the extension randomises context, zeroes sensitive memory, and exposes sign/verify/recover (Ethereum-style) in a thread-safe package—production-ready for FPM/CLI/frameworks. (DEV Community)

Enter `php-keccak256`: lightning-fast hashing

Keccak-256 (often called SHA-3) underpins Ethereum: address derivation, transaction hashing, event topics—the works. Ethereum externally owned account (EOA) addresses are the last 20 bytes of the Keccak-256 hash of the uncompressed public key. Pure PHP clocks ~0.28–0.44 ms per hash; the native extension cuts this to ~0.018–0.032 ms—about 15× faster. A million hashes drop from minutes to under half a minute. (Ethereum Stack Exchange)

<?php
// Hash any string and return hex output by default (or raw binary if $raw = true)
$hash = keccak_hash($data, $raw = false);

Putting it together: an end-to-end Ethereum workflow in PHP

<?php
// 1) Prepare transaction data and compute its Keccak-256 hash
$messageHash = keccak_hash($transactionData);

// 2) Sign the hash with a secp256k1 private key
$signature   = secp256k1_sign($messageHash, $privateKey);

// 3) Recover the public key (useful for smart-contract signatures)
$publicKey   = secp256k1_recover($messageHash, $signature);

// 4) Derive Ethereum address: last 20 bytes of Keccak(pubkey)
$address     = '0x' . substr(keccak_hash(hex2bin($publicKey)), -40);

That one PHP snippet signs transactions, recovers the signer, and derives an address—no external process or second language required. And because signing and hashing now run in microseconds, you can build dApps, payment gateways, or nodes that chew through tens of thousands of ops per second on commodity hardware. (DEV Community)

Getting started

# Dependencies
sudo apt-get update
sudo apt-get install -y libsecp256k1-dev libssl-dev php-dev build-essential

# php-secp256k1
git clone https://github.com/BuildCoreWorks/php-secp256k1.git
cd php-secp256k1 && phpize && ./configure && make && sudo make install
echo "extension=secp256k1.so" | sudo tee /etc/php/8.1/mods-available/secp256k1.ini
sudo phpenmod secp256k1

# php-keccak256
git clone https://github.com/BuildCoreWorks/php-keccak256.git
cd php-keccak256 && phpize && ./configure && make && sudo make install
echo "extension=keccak.so" | sudo tee /etc/php/8.1/mods-available/keccak.ini
sudo phpenmod keccak

Both extensions are open source; see the GitHub READMEs for full docs and benchmarks. (GitHub)

Why secp256k1 & Keccak-256 (quick context)

secp256k1 was selected for Bitcoin/Ethereum and, when well-optimised, can outperform other common curves thanks to its structure. (Bitcoin Wiki)
Keccak-256 (Ethereum’s hashing workhorse) is used for address derivation, transaction hashing, and more. (Ethereum Stack Exchange)

Ready to build?

Performance shouldn’t be a blocker for innovation. With php-secp256k1 and php-keccak256, PHP developers can compete with Go and Rust without leaving PHP. Whether you’re building a high-frequency exchange, an NFT marketplace, or an Ethereum login service, these extensions open new possibilities. Try them, benchmark your workloads, and tell us what you build.

References & further reading

BuildCoreWorks — High-performance secp256k1 for PHP (benchmarks, install, code) (DEV Community)
BuildCoreWorks — High-performance Keccak-256 for PHP (benchmarks, install, code) (DEV Community)
Bitcoin Wiki — Why secp256k1 is fast/efficient (Bitcoin Wiki)
Ethereum Stack Exchange — How addresses are derived (last 20 bytes of Keccak-256(pubkey)) (Ethereum Stack Exchange)
JetBrains Developer Ecosystem / Accesto — PHP remains broadly used in production (The JetBrains Blog)

Written By AI

Building High-Performance Secp256k1 ECDSA for PHP: 2,987 Faster

BuildCoreWorks — Wed, 15 Oct 2025 13:28:57 +0000

Making PHP Viable for Blockchain Development

PHP is rarely used for blockchain applications, and for good reason: pure PHP implementations of secp256k1 ECDSA operations are prohibitively slow. Signing a single transaction can take 90-136 milliseconds—far too slow for production cryptocurrency wallets or blockchain nodes.

But what if we could make PHP 2,500-3,000× faster at cryptography?

The Challenge

Secp256k1 is the elliptic curve used by Bitcoin and Ethereum for signing transactions. It requires complex mathematical operations:

Point multiplication on an elliptic curve
Modular arithmetic with 256-bit integers
Secure random number generation

PHP, being an interpreted language, struggles with these operations. The best pure PHP implementation (kornrunner/secp256k1) takes:

90-136ms per signature
100-135ms per verification
No support for public key recovery

For context, a blockchain node processing 1,000 transactions per second would need:

Signing: 90-136 seconds in pure PHP
Verification: 100-135 seconds in pure PHP

That's 2-4 minutes per second of transactions. Clearly impractical.

The Solution: C Extension

By wrapping the official libsecp256k1 library (used by Bitcoin Core) in a PHP extension, we achieve:

0.03-0.06ms per signature
0.04-0.06ms per verification
Full support for public key recovery (Ethereum-style)

That's 2,400-3,000× faster than pure PHP.

Performance Benchmarks

Hardware	Operation	C Extension	Pure PHP	Speedup
Intel i3-2130 (2011)	Sign	0.045 ms	112.9 ms	2,509×
AMD Ryzen 7 3700X	Sign	0.030 ms	89.6 ms	2,987×

Real-world impact:

100,000 signatures: 3-5 seconds (C) vs 2.5-3 hours (PHP)
1,000,000 signatures: 30-45 seconds (C) vs 25-31 hours (PHP)

Implementation Details

The extension provides three functions:

// Sign a message hash
$signature = secp256k1_sign($messageHash, $privateKey);
// Returns: r (64 hex) + s (64 hex) + v (2 hex) = 130 characters

// Verify a signature
$isValid = secp256k1_verify($messageHash, $signature, $publicKey);
// Returns: true or false

// Recover public key (Ethereum-style)
$publicKey = secp256k1_recover($messageHash, $signature);
// Returns: 128-character hex (X + Y coordinates)

Ethereum Address Derivation

// Complete Ethereum workflow
$messageHash = keccak_hash($transactionData);
$signature = secp256k1_sign($messageHash, $privateKey);
$publicKey = secp256k1_recover($messageHash, $signature);
$address = '0x' . substr(keccak_hash(hex2bin($publicKey)), -40);

Security Features

Thread-safe: Uses pthread mutex for ZTS compatibility
Context randomization: Uses OpenSSL's CSPRNG on initialization
Secure memory: All private keys and hashes are zeroed after use
Battle-tested: Wraps libsecp256k1 from Bitcoin Core (production since 2015)

Real-World Applications

With this performance, PHP becomes viable for:

Cryptocurrency wallets: Sign transactions in real-time
Blockchain nodes: Process thousands of TPS per node
dApp backends: Server-side transaction signing
Payment APIs: High-throughput Bitcoin/Ethereum processing
Authentication systems: ECDSA-based login

Blockchain Node Performance

With this extension, a single PHP process can:

Sign ~33,000 transactions per second
Verify ~18,000 signatures per second
Combined throughput: ~16,600 TPS

This makes real-time blockchain implementations in PHP feasible, including gaming blockchains with sub-100ms block times.

Installation

# Install dependencies
sudo apt-get install libsecp256k1-dev libssl-dev php-dev

# Build extension
git clone https://github.com/BuildCoreWorks/php-secp256k1.git
cd php-secp256k1
phpize && ./configure && make && sudo make install

# Enable extension
echo "extension=secp256k1.so" | sudo tee /etc/php/8.1/mods-available/secp256k1.ini
sudo phpenmod secp256k1

Try It Yourself

Full benchmarks, documentation, and code examples are available on GitHub:
https://github.com/BuildCoreWorks/php-secp256k1
Combined with our php-keccak256 extension, PHP developers now have complete, production-grade cryptography tools for Bitcoin and Ethereum development.

Conclusion

By leveraging C extensions for cryptographic operations, PHP transforms from "too slow for blockchain" to a viable platform for production cryptocurrency applications. The 2,500-3,000× performance improvement isn't incremental—it's the difference between impossible and practical.

This opens new possibilities:

Building blockchain nodes in a language millions of developers know
Rapid prototyping of cryptocurrency applications
Enterprise blockchain solutions using existing PHP infrastructure
Educational blockchain projects with accessible technology

The extension is open source (MIT licensed) and production-ready. We're using it for a PHP blockchain implementation capable of real-time transaction processing.

Try it out and let me know what you build with it!

GitHub: https://github.com/BuildCoreWorks/php-secp256k1

Building a High-Performance Keccak-256 Extension for PHP: 14-16 Faster

BuildCoreWorks — Tue, 14 Oct 2025 08:27:11 +0000

The Problem:
Pure PHP Keccak hashing: 0.28-0.44ms per hash
At scale, this makes Ethereum development impractical

The Solution:
C extension using direct memory operations
Benchmarked results: 0.018-0.032ms per hash

Performance:

Intel i3-2130 (2011): 0.032ms vs 0.443ms = 14× faster
AMD Ryzen 7 3700X: 0.018ms vs 0.280ms = 16× faster
Works in Docker and bare metal