Home » Encryption » Crypt_HMAC » Bug #550

[2004-01-09 16:44 UTC] jury at hightech dot lv

Description:
------------
SHA Calculation is depeding on length of generating Hash:

Was:
$inner = pack("H32", $func($this->_ipad . $data));

Patch To:
$inner = pack("H" . (($func == "sha1") ? "40" : "32"), $func($this->_ipad . $data));

At least seems that in initialisation function there also is "pack" with "H32" to be patched.

Reproduce code:
---------------
$CryptObj = new Crypt_HMAC("1234", "sha1");
echo strtoupper($CryptObj->Hash("test"));

Expected result:
----------------
6455FDB217CFE086953A844DABAC0491B05D91D2

Actual result:
--------------
63066F77A255A47DCE2AA60ED421D50678F7F89B

[2004-02-11 10:31 UTC] jury at hightech dot lv

This Is Patched Version of HMAC:

<?php
/* vim: set expandtab tabstop=4 shiftwidth=4: */
// +----------------------------------------------------------------------+
// | PHP Version 4 |
// +----------------------------------------------------------------------+
// | Copyright (c) 1997-2003 The PHP Group |
// +----------------------------------------------------------------------+
// | This source file is subject to version 2.0 of the PHP license, |
// | that is bundled with this package in the file LICENSE, and is |
// | available at through the world-wide-web at |
// | http://www.php.net/license/2_02.txt. |
// | If you did not receive a copy of the PHP license and are unable to |
// | obtain it through the world-wide-web, please send a note to |
// | license@php.net so we can mail you a copy immediately. |
// +----------------------------------------------------------------------+
// | Authors: Derick Rethans <d.rethans@jdimedia.nl> |
// +----------------------------------------------------------------------+
//
// $Id: HMAC.php,v 1.1 2003/02/16 20:34:16 derick Exp $

/**
* Calculates RFC 2104 compliant HMACs
*
* @version $Revision: 1.1 $
* @access public
* @package Crypt
* @author Derick Rethans <d.rethans@jdimedia.nl>
*/
class Crypt_HMAC {

/**
* Hash function to use
* @var string
*/
var $_func;

/**
* Inner padded key
* @var string
*/
var $_ipad;

/**
* Outer padded key
* @var string
*/
var $_opad;

/**
* Constructor
* Pass method as first parameter
*
* @param string method - Hash function used for the calculation
* @return void
* @access public
*/
function Crypt_HMAC($key, $method = 'md5')
{
if (!in_array($method, array('sha1', 'md5'))) {
die("Unsupported hash function '$method'.");
}
$this->_func = $method;

/* Pad the key as the RFC wishes */
if (strlen($key) > 64) {
$key = pack("H" . (($func == "sha1") ? "40" : "32"), $method($key));
}

if (strlen($key) < 64) {
$key = str_pad($key, 64, chr(0));
}

/* Calculate the padded keys and save them */
$this->_ipad = (substr($key, 0, 64) ^ str_repeat(chr(0x36), 64));
$this->_opad = (substr($key, 0, 64) ^ str_repeat(chr(0x5C), 64));
}

/**
* Hashing function
*
* @param string data - string that will encrypted
* @return string
* @access public
*/
function hash($data)
{
$func = $this->_func;
$inner = pack("H" . (($func == "sha1") ? "40" : "32"), $func($this->_ipad . $data));
$digest = $func($this->_opad . $inner);
return $digest;
}
}
?>

[2004-02-11 10:34 UTC] jury at hightech dot lv

With connectivity-wbxml when you make security verefication.
They use HMAC SHA1
Alsougth you can read RFC about HMAC'it.

[2004-09-23 16:13 UTC] mcorne at yahoo dot com

The package does not work against the Test Cases for HMAC-MD5 and HMAC-SHA-1 published at the following address: http://xml.resource.org/public/rfc/html/rfc2202.html.
The correction proposed below is right.

I enhanced the class so it could calculate the HMAC of other hash methods. I also create a test class to verify the code against the Test Cases mentioned above.

I would be happy to contribute to the Pear community with this enhancement. Let me know what I should do.

[2004-09-23 17:01 UTC] php at derickrethans dot nl

E-mail me the patch and I'll have a look at it.