1

I am writing a script to talk with twitter - everything seems fine apart from generating a correct signature, where I get an access error. However, changing my variables to match those on the twitter documentation comes up with a different result. At the bottom of https://dev.twitter.com/docs/auth/creating-signature, it says:

For example, the output given the base string and signing key 
given on this page is 
      B6 79 C0 AF 18 F4 E9 C5 87 AB 8E 20 0A CD 4E 48 A9 3F 8C B6

My code produces almost the same thing - just no spaces and lowercase. However when I base64_encode() it, I don't get the same value as in the documentation (tnnArxj06cWHq44gCs1OSKk/jLY=), even trying with different case/spacing/etc:

echo base64_encode('B679C0AF18F4E9C587AB8E200ACD4E48A93F8CB6');
echo strtolower(base64_encode('B679C0AF18F4E9C587AB8E200ACD4E48A93F8CB6'));
echo base64_encode('B6 79 C0 AF 18 F4 E9 C5 87 AB 8E 20 0A CD 4E 48 A9 3F 8C B6');
echo base64_encode(strtolower('B6 79 C0 AF 18 F4 E9 C5 87 AB 8E 20 0A CD 4E 48 A9 3F 8C B6'));

Resulting:

QjY3OUMwQUYxOEY0RTlDNTg3QUI4RTIwMEFDRDRFNDhBOTNGOENCNg==
qjy3oumwquyxoey0rtldntg3qui4rtiwmefdrdrfndhbotngoencng==
QjYgNzkgQzAgQUYgMTggRjQgRTkgQzUgODcgQUIgOEUgMjAgMEEgQ0QgNEUgNDggQTkgM0YgOEMgQjY=
YjYgNzkgYzAgYWYgMTggZjQgZTkgYzUgODcgYWIgOGUgMjAgMGEgY2QgNGUgNDggYTkgM2YgOGMgYjY=

Am I missing something obvious here?

  • Base64 might be case insensitive. – Ondřej Mirtes Jun 24 '12 at 16:09
  • "[..]even trying with different case/spacing/etc[..]" – LeonardChallis Jun 24 '12 at 16:10
2

You have a misunderstanding of Base64.

Base64 takes an array of bytes of any value (0-255) and encodes those bytes into a printable data string, using the digits 0-9, A-Z, a-z, and + and / .

Just as base10 uses the digits 0-9, and base2 uses 0 and 1, base64 uses characters from the alphabet to represent numeric digits. An A in base64 is not the same as an a. Therefore your use of strtolower() on a base64-encoded string is not going to yield any joy.

ok. now back to twitter, they say the result is:

B6 79 C0 AF 18 F4 E9 C5 87 AB 8E 20 0A CD 4E 48 A9 3F 8C B6

Those are hex digits. That is not a base64-encoded value. If you base64 it, you will get something else (more data to follow).

If you put that into a string, and try to base64 encode the string, you will once again fail. Twitter is not saying "this is the string you should get." It's saying, this is the byte array you should get.

Furshtay?


This code

$p = pack("C*", 0xB6, 0x79, 0xC0, 0xAF, 0x18, 0xF4, 0xE9, 0xC5, 0x87,
          0xAB, 0x8E, 0x20, 0x0A, 0xCD, 0x4E, 0x48, 0xA9, 0x3F, 0x8C, 0xB6);
$b64 = base64_encode($p);
echo "base64: " . $b64 . "\n";

yields:

base64: tnnArxj06cWHq44gCs1OSKk/jLY=
  • Ahh - so I can get the raw output from hash_hmac() and base64_encode() that. :D – LeonardChallis Jun 24 '12 at 16:25
1

You first need to turn the hexadecimal string into binary:

$bin = pack('H*', 'B679C0AF18F4E9C587AB8E200ACD4E48A93F8CB6');
var_dump(base64_encode($bin) === 'tnnArxj06cWHq44gCs1OSKk/jLY=');

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.