0

I'm trying to enable HMAC Hashing (SHA256) with PHP 5.0.4 and using phpseclib (to my knowledge in this case phpseclib relies on a native PHP spec), the sample code I'm using it's pretty simple:


    include('Crypt/Hash.php');

    $hash = new Crypt_Hash('sha256');
    $hash->setKey('abcdefg');
    echo bin2hex($hash->hash('something'));

it generates an HMAC with this string:

e678e33c727ddf7172d3521cf9c0c2a15b66e03eb96d77795fa4adb338dc24a9

But apparently, this string is invalid because doing the same with this online tools:

http://www.freeformatter.com/hmac-generator.html

http://beautifytools.com/hmac-generator.php

http://www.jetcityorange.com/hmac/

I get this string:

9a43ff294bdfed399e2d5a3d739a4efb7eccc23269b80b3f0d855937d35ae06f

What am I doing wrong?

Note: SHA1 encoding works perfectly.

Thanks in advance.

10
  • Pretty sure PHP added native HMAC support in 5.1.X, can you update PHP? Sep 1, 2016 at 15:40
  • 9a43ff294bdfed399e2d5a3d739a4efb7eccc23269b80b3f0d855937d35ae06f is the correct hash. Part of the problem is passing options in as strings, any string will pass a syntax check.
    – zaph
    Sep 1, 2016 at 15:57
  • I tried it on PHP 5.0.5 and got the 9a43ff29 string. Crypt_Hash has three different modes: mhash, hash and internal. mhash and internal are available on PHP 5.0. When I tried it the internal mode was used. Maybe your server has mhash installed? Can you post your phpinfo() output?
    – neubert
    Sep 4, 2016 at 5:36
  • @iamgory I know it, but I can't update PHP version, thanks anyway
    – Nibble
    Sep 6, 2016 at 6:50
  • @neubert No, I don't have mhash installed. There's no reference to any hash or crypt package on phpinfo() output.
    – Nibble
    Sep 6, 2016 at 6:56

1 Answer 1

1

It was a problem related to float to int conversions on 32-bit Linux pre-PHP 5.3. Developers of phpseclib fixed the issue on version 1.0.4 & 2.0.4

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.