Wrong HMAC using PHP 5.0.4

Question

I'm trying to enable HMAC Hashing (SHA256) with PHP 5.0.4 and using phpseclib (to my knowledge in this case phpseclib relies on a native PHP spec), the sample code I'm using it's pretty simple:


    include('Crypt/Hash.php');

    $hash = new Crypt_Hash('sha256');
    $hash->setKey('abcdefg');
    echo bin2hex($hash->hash('something'));

it generates an HMAC with this string:

e678e33c727ddf7172d3521cf9c0c2a15b66e03eb96d77795fa4adb338dc24a9

But apparently, this string is invalid because doing the same with this online tools:

http://www.freeformatter.com/hmac-generator.html

http://beautifytools.com/hmac-generator.php

http://www.jetcityorange.com/hmac/

I get this string:

9a43ff294bdfed399e2d5a3d739a4efb7eccc23269b80b3f0d855937d35ae06f

What am I doing wrong?

Note: SHA1 encoding works perfectly.

Thanks in advance.

Pretty sure PHP added native HMAC support in 5.1.X, can you update PHP? — iamgory
9a43ff294bdfed399e2d5a3d739a4efb7eccc23269b80b3f0d855937d35ae06f is the correct hash. Part of the problem is passing options in as strings, any string will pass a syntax check. — zaph
I tried it on PHP 5.0.5 and got the 9a43ff29 string. Crypt_Hash has three different modes: mhash, hash and internal. mhash and internal are available on PHP 5.0. When I tried it the internal mode was used. Maybe your server has mhash installed? Can you post your phpinfo() output? — neubert
@iamgory I know it, but I can't update PHP version, thanks anyway — Nibble
@neubert No, I don't have mhash installed. There's no reference to any hash or crypt package on phpinfo() output. — Nibble

Nibble Nibble · Accepted Answer · 2016-10-06T08:03:56

It was a problem related to float to int conversions on 32-bit Linux pre-PHP 5.3. Developers of phpseclib fixed the issue on version 1.0.4 & 2.0.4

Wrong HMAC using PHP 5.0.4

1 Answers