Bug #7490

setFunction() after setKey() breaks for keys requiring hashing

Details

Submitted	2006-04-25 22:31 UTC
From	chad at herballure dot com
Assigned	mfonda
Status	Closed
Package	Crypt_HMAC
PHP Version	Irrelevant
Roadmaps	(Not assigned)

Comments

[2006-04-25 22:31 UTC] chad at herballure dot com

Description:
------------
I was unit-testing an internal port of Crypt_HMAC to PHP5, when I discovered that a key long enough to require hashing is hashed with whatever function was set when setKey was called. If the hash function is changed later with setFunction, then the _ipad and _opad variables are incorrect (having been produced with the wrong hash).

Testing with data from RFC 2202; the data used below is SHA-1 case 6.

Test script:
---------------
$long_key = pack('H80',
'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa' .
'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa' .
'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa' .
'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa');
// long_key is 80 bytes of 0xaa

$hmac = new Crypt_HMAC($long_key);
$hmac->setFunction('sha1');
echo($hmac->hash('Test Using Larger Than Block-Size Key - Hash Key First'));

Expected result:
----------------
aa4ae5e15272d00e95705637ce8a3b55ed402112

Actual result:
--------------
78a32997ffa1e0719e61e533c2fb19fe7e85d44f

[2006-06-06 16:50 UTC] chad at herballure dot com

An edit of the documentation is really what I expect to happen. I only found this bug by pathological testing, not by stumbling over it in live code.