[UPD] rel v4.1.0

Author: GianfriAur

.github/workflows/tests.yml

@@ -41,7 +41,7 @@ jobs:
 
       - name: Start OPC UA test servers
         id: opcua
-        uses: php-opcua/uanetstandard-test-suite@v1.0.0
+        uses: php-opcua/uanetstandard-test-suite@v1.1.0
 
       - name: Run tests
         env:

CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## [4.1.0] - 2026-04-13
+
+### Added
+
+- **ECC security policy support.** `security_policy` config key now accepts `ECC_nistP256`, `ECC_nistP384`, `ECC_brainpoolP256r1`, and `ECC_brainpoolP384r1` in addition to the existing 6 RSA policies. Added to `resolveSecurityPolicyUri()` in both `OpcuaManager` and `SessionCommand`. No `client_certificate`/`client_key` needed — ECC certificates are auto-generated when omitted. Username/password authentication uses the `EccEncryptedSecret` protocol automatically.
+  - **ECC disclaimer:** No commercial OPC UA vendor supports ECC endpoints yet. This implementation is tested exclusively against the OPC Foundation's UA-.NETStandard reference stack.
+
+### Changed
+
+- Bumped minimum `php-opcua/opcua-client` dependency from `^4.0.0` to `^4.1` and `php-opcua/opcua-session-manager` from `^4.0.3` to `^4.1`.
+- Security support expanded from 6 to **10 policies** (6 RSA + 4 ECC).
+- Updated CI test server suite from `php-opcua/uanetstandard-test-suite@v1.0.0` to `@v1.1.0`.
+- Updated `config/opcua.php` security policy comment to list all 10 available policies including ECC.
+- Updated documentation (README, doc/07-security.md, doc/09-examples.md, llms.txt, llms-full.txt, llms-skills.md) to reflect ECC support, add ECC `.env` examples, and include the ECC disclaimer.
+
 ## [4.0.1] - 2026-04-09
 
 ### Added

README.md

@@ -56,6 +56,7 @@ composer require php-opcua/laravel-opcua
 ```
 
 ```dotenv
+# RSA security (or use ECC: ECC_nistP256, ECC_nistP384, ECC_brainpoolP256r1, ECC_brainpoolP384r1)
 OPCUA_ENDPOINT=opc.tcp://192.168.1.100:4840
 ```
 
@@ -255,7 +256,9 @@ echo $mock->callCount('read'); // 1
 | **Auto-Batching** | `readMulti`/`writeMulti` transparently split when exceeding server limits |
 | **Recursive Browse** | `browseAll()`, `browseRecursive()` with depth control and cycle detection |
 | **Path Resolution** | `resolveNodeId('/Objects/Server/ServerStatus')` |
-| **Security** | 6 policies, 3 auth modes, auto-generated certs, certificate trust management |
+| **Security** | 10 policies (RSA + ECC), 3 auth modes, auto-generated certs, certificate trust management |
+
+> **ECC disclaimer:** ECC security policies (`ECC_nistP256`, `ECC_nistP384`, `ECC_brainpoolP256r1`, `ECC_brainpoolP384r1`) are fully implemented and tested against the OPC Foundation's UA-.NETStandard reference stack. However, no commercial OPC UA vendor supports ECC endpoints yet. When using ECC, client certificates are auto-generated if `client_certificate`/`client_key` are omitted, and username/password authentication uses the `EccEncryptedSecret` protocol automatically.
 | **History Read** | Raw, processed, and at-time historical queries |
 | **Typed Returns** | All service responses return `public readonly` DTOs |
 
@@ -276,7 +279,7 @@ echo $mock->callCount('read'); // 1
 
 ## Testing
 
-80+ unit tests with **99%+ code coverage**. Integration tests run against [uanetstandard-test-suite](https://github.com/php-opcua/uanetstandard-test-suite) — a Docker-based OPC UA environment built on the OPC Foundation's UA-.NETStandard reference implementation — in both direct and managed (daemon) modes.
+146+ unit tests with **99%+ code coverage**. Integration tests run against [uanetstandard-test-suite](https://github.com/php-opcua/uanetstandard-test-suite) — a Docker-based OPC UA environment built on the OPC Foundation's UA-.NETStandard reference implementation — in both direct and managed (daemon) modes.
 
 ```bash
 ./vendor/bin/pest tests/Unit/                              # unit only

ROADMAP.md

@@ -2,7 +2,7 @@
 
 > **A note on versioning:** We're aware of the rapid major releases in a short time frame. This library is under active, full-time development right now — the goal is to reach a production-stable state as quickly as possible. Breaking changes are being bundled and shipped deliberately to avoid dragging them out across many minor releases. Once the API surface settles, major version bumps will become rare. Thanks for your patience.
 
-## v4.0.0
+## Planned
 
 ### Features
 
@@ -21,6 +21,13 @@
 - [ ] Middleware — `EnsureOpcuaConnected` middleware that guarantees a live connection for the duration of the request and disconnects in `terminate()`
 - [ ] Lazy proxy — return a lazy proxy from `connection()` that defers the actual TCP/IPC handshake until the first operation, reducing boot overhead when the connection may not be needed
 
+## Completed in v4.1.0
+
+- [x] **ECC security policy support** — `security_policy` config key accepts `ECC_nistP256`, `ECC_nistP384`, `ECC_brainpoolP256r1`, `ECC_brainpoolP384r1`
+- [x] ECC mapping in both `OpcuaManager::resolveSecurityPolicyUri()` and `SessionCommand::resolveSecurityPolicyUri()`
+- [x] Security support expanded from 6 to **10 policies** (6 RSA + 4 ECC)
+- [x] Updated all documentation and AI-ready files
+
 ## Won't Do (by design)
 
 ### Merge opcua-client or session-manager code

composer.json

@@ -11,8 +11,8 @@
     ],
     "require": {
         "php": "^8.2",
-        "php-opcua/opcua-client": "^4.0.0",
-        "php-opcua/opcua-session-manager": "^4.0.3",
+        "php-opcua/opcua-client": "^4.1",
+        "php-opcua/opcua-session-manager": "^4.1",
         "psr/event-dispatcher": "^1.0",
         "illuminate/support": "^11.0|^12.0|^13.0",
         "illuminate/console": "^11.0|^12.0|^13.0",

config/opcua.php

@@ -67,7 +67,7 @@
             'endpoint' => env('OPCUA_ENDPOINT', 'opc.tcp://localhost:4840'),
 
             // Security (optional)
-            'security_policy' => env('OPCUA_SECURITY_POLICY','None'), // None, Basic128Rsa15, Basic256, Basic256Sha256, Aes128Sha256RsaOaep, Aes256Sha256RsaPss
+            'security_policy' => env('OPCUA_SECURITY_POLICY','None'), // None, Basic128Rsa15, Basic256, Basic256Sha256, Aes128Sha256RsaOaep, Aes256Sha256RsaPss, ECC_nistP256, ECC_nistP384, ECC_brainpoolP256r1, ECC_brainpoolP384r1
             'security_mode' => env('OPCUA_SECURITY_MODE','None'),     // None, Sign, SignAndEncrypt
 
             // User authentication (optional)

doc/02-installation.md

@@ -102,7 +102,7 @@ Each connection can have its own endpoint, security settings, and credentials:
 | Key | Default | Description |
 |-----|---------|-------------|
 | `endpoint` | `opc.tcp://localhost:4840` | OPC UA server URL |
-| `security_policy` | `None` | Security policy name or URI |
+| `security_policy` | `None` | Security policy name or URI (see [Security](07-security.md) for all 10 policies including ECC) |
 | `security_mode` | `None` | `None`, `Sign`, or `SignAndEncrypt` |
 | `username` / `password` | `null` | Username/password authentication |
 | `client_certificate` / `client_key` | `null` | Client certificate (auto-generated if omitted) |

doc/07-security.md

@@ -12,8 +12,12 @@ Each policy defines the algorithms used for encryption and signing:
 | Basic256Sha256 | RSA-SHA256 | RSA-OAEP | HMAC-SHA256 | AES-256-CBC | 2048 bit |
 | Aes128Sha256RsaOaep | RSA-SHA256 | RSA-OAEP | HMAC-SHA256 | AES-128-CBC | 2048 bit |
 | Aes256Sha256RsaPss | RSA-PSS-SHA256 | RSA-OAEP-SHA256 | HMAC-SHA256 | AES-256-CBC | 2048 bit |
+| ECC_nistP256 | ECDSA-SHA256 | ECDH (P-256) | HMAC-SHA256 | AES-128-CBC | P-256 |
+| ECC_nistP384 | ECDSA-SHA384 | ECDH (P-384) | HMAC-SHA384 | AES-256-CBC | P-384 |
+| ECC_brainpoolP256r1 | ECDSA-SHA256 | ECDH (BP-256) | HMAC-SHA256 | AES-128-CBC | BP-256 |
+| ECC_brainpoolP384r1 | ECDSA-SHA384 | ECDH (BP-384) | HMAC-SHA384 | AES-256-CBC | BP-384 |
 
-> **Tip:** For new deployments, use `Basic256Sha256` or `Aes256Sha256RsaPss`. The older policies (`Basic128Rsa15`, `Basic256`) exist for legacy server compatibility.
+> **Tip:** For new deployments, use `Basic256Sha256`, `Aes256Sha256RsaPss`, or one of the ECC policies. ECC policies use Elliptic Curve Diffie-Hellman for key agreement and HKDF for key derivation instead of RSA encryption — they offer equivalent security with smaller keys and faster handshakes. The older policies (`Basic128Rsa15`, `Basic256`) exist for legacy server compatibility.
 
 ## Security Modes
 
@@ -109,7 +113,7 @@ openssl x509 -req -in client.csr -CA ca.pem -CAkey ca.key \
 
 ### Auto-Generated Certificates
 
-When a security policy and mode are configured but no `client_certificate` / `client_key` are provided, the underlying client automatically generates a self-signed RSA 2048 certificate in memory with proper OPC UA extensions.
+When a security policy and mode are configured but no `client_certificate` / `client_key` are provided, the underlying client automatically generates a self-signed certificate in memory with proper OPC UA extensions. For RSA policies, a 2048-bit RSA certificate is generated. For ECC policies, an EC certificate matching the policy's curve (NIST P-256/P-384 or Brainpool P-256/P-384) is generated.
 
 ```php
 'connections' => [
@@ -164,7 +168,7 @@ The `security_policy` config key accepts both short names and full OPC UA URIs:
 'security_policy' => 'http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256',
 ```
 
-Supported short names: `None`, `Basic128Rsa15`, `Basic256`, `Basic256Sha256`, `Aes128Sha256RsaOaep`, `Aes256Sha256RsaPss`.
+Supported short names: `None`, `Basic128Rsa15`, `Basic256`, `Basic256Sha256`, `Aes128Sha256RsaOaep`, `Aes256Sha256RsaPss`, `ECC_nistP256`, `ECC_nistP384`, `ECC_brainpoolP256r1`, `ECC_brainpoolP384r1`.
 
 ## Mode Resolution
 
@@ -206,7 +210,7 @@ Client                          Server
 
 **Phase 1 — Discovery.** The client connects without security, calls `GetEndpoints`, and retrieves the server's certificate.
 
-**Phase 2 — Asymmetric (OpenSecureChannel).** The client sends an OPN request encrypted with the server's public key. Both sides exchange nonces. Symmetric keys are derived from the shared nonces.
+**Phase 2 — Asymmetric (OpenSecureChannel).** For RSA policies, the client sends an OPN request encrypted with the server's public key; both sides exchange nonces and derive symmetric keys via P_SHA. For ECC policies, the OPN is signed (not encrypted) with ECDSA; both sides exchange ephemeral EC public keys and derive symmetric keys via ECDH + HKDF.
 
 **Phase 3 — Symmetric (Session + Messages).** All subsequent messages (CreateSession, ActivateSession, Read, Write, etc.) use the derived symmetric keys — signed with HMAC and encrypted with AES-CBC.
 

doc/09-examples.md

@@ -301,6 +301,27 @@ echo $value->getValue();
 $client->disconnect();
 ```
 
+## ECC Secure Connection
+
+```php
+use PhpOpcua\LaravelOpcua\Facades\Opcua;
+
+// ECC security — no client certificate needed (auto-generated)
+$client = Opcua::connectTo('opc.tcp://10.0.0.10:4840', [
+    'security_policy' => 'ECC_nistP256',
+    'security_mode'   => 'SignAndEncrypt',
+    'username'        => 'operator',
+    'password'        => 'secret',
+]);
+
+$value = $client->read('ns=2;i=1001');
+echo $value->getValue();
+
+$client->disconnect();
+```
+
+> **ECC disclaimer:** ECC security policies (`ECC_nistP256`, `ECC_nistP384`, `ECC_brainpoolP256r1`, `ECC_brainpoolP384r1`) are fully implemented and tested against the OPC Foundation's UA-.NETStandard reference stack. No commercial OPC UA vendor supports ECC endpoints yet.
+
 ## Multiple Connections
 
 ```php

llms-full.txt

@@ -57,7 +57,7 @@ New in v4.0.1 (per-connection):
 | Key | Default | Description |
 |-----|---------|-------------|
 | endpoint | opc.tcp://localhost:4840 | Server URL |
-| security_policy | None | None, Basic128Rsa15, Basic256, Basic256Sha256, Aes128Sha256RsaOaep, Aes256Sha256RsaPss |
+| security_policy | None | None, Basic128Rsa15, Basic256, Basic256Sha256, Aes128Sha256RsaOaep, Aes256Sha256RsaPss, ECC_nistP256, ECC_nistP384, ECC_brainpoolP256r1, ECC_brainpoolP384r1 |
 | security_mode | None | None, Sign, SignAndEncrypt |
 | username / password | null | User authentication |
 | client_certificate / client_key | null | Client cert (auto-generated if omitted) |
@@ -326,10 +326,10 @@ $repo = $client->getExtensionObjectRepository();
 
 ## Security
 
-6 policies: None, Basic128Rsa15, Basic256, Basic256Sha256, Aes128Sha256RsaOaep, Aes256Sha256RsaPss.
+10 policies: None, Basic128Rsa15, Basic256, Basic256Sha256, Aes128Sha256RsaOaep, Aes256Sha256RsaPss, ECC_nistP256, ECC_nistP384, ECC_brainpoolP256r1, ECC_brainpoolP384r1.
 3 modes: None, Sign, SignAndEncrypt.
 3 auth methods: Anonymous, Username/Password, X.509 Certificate.
-Auto-generated client certificates when policy/mode set but no cert provided.
+Auto-generated client certificates when policy/mode set but no cert provided (RSA 2048 for RSA policies, EC matching curve for ECC policies).
 Certificate trust management via FileTrustStore with configurable TrustPolicy.
 
 ## MockClient (Testing)