While working on sodium_compat, our pure-PHP implementation of libsodium, it has come to our attention that a lot of the engineering decisions we’ve made to minimize the risk of side-channels aren’t well-known outside of our development team.

source: HN