Using HMAC Verification in PHP
By: Andi, Stig and Derick in PHP Tutorials on 2008-11-23
If you need to prevent bad guys from tampering with variables passed in the URL (such as for a redirect as shown previously, or for links that pass special parameters to the linked script), you can use a hash, as shown in the following script:
<?php function create_parameters($array) { $data = ''; $ret = array(); /* For each variable in the array we a string containing * "$key=$value" to an array and concatenate * $key and $value to the $data string. */ foreach ($array as $key => $value) { $data .= $key . $value; $ret[] = "$key=$value"; } /* We also add the md5sum of the $data as element * to the $ret array. */ $hash = md5($data); $ret[] = "hash=$hash"; return join ('&', $ret); } echo '<a href="script.php?'. create_parameters(array('cause' =>'vars')).'">err!</a>'; ?>
Running this script echoes the following link:
<a href='script.php?cause=vars&hash=8eee14fe10d3f612589cdef079c025f6'>err!</a>
However, this URL is still vulnerable. An attacker can modify both the variables and the hash. We must do something better. We"re not the first ones with this problem, so there is an existing solution: HMAC (Keyed-Hashing for Message Authentication). The HMAC method is proven to be stronger cryptographically, and should be used instead of home-cooked validation algorithms.
The HMAC algorithm uses a secret key in a two-step hashing of plain text (in our case, the string containing the key/value pairs) with the following steps:
-
If the key length is smaller than 64 bytes (the block size that most hashing algorithms use), we pad the key to 64 bytes with \0s; if the key length is larger than 64, we first use the hash function on the key and then pad it to 64 bytes with \0s.
-
We construct opad (the 64-byte key XORed with 0x5C) and ipad (the 64-byte key XORed with 0x36).
-
We create the "inner" hash by running the hash function with the parameter ipad . plain text. (Because we use an "iterative" hash function, like md5() or sha1(), we don't need to seed the hash function with our key and then run the seeded hash function over our plain text. Internally, the hash will do the same anyway, which is the reason we padded the key up to 64 bytes).
-
We create the "outer" hash by running the hash function over opad inner_result - that is, using the result obtained in step 3.
Here is the formula to calculate HMAC, which should help you understand the calculation:
H(K XOR opad, H(K XOR ipad, text))
With
-
H. The hash function to use
-
K. The key padded to 64 bytes with zeroes (0x0)
-
opad. The 64 bytes of 0x5Cs
-
ipad. The 64 bytes of 0x36s
-
text. The plain text for which we are calculating the hash
Add Comment
This policy contains information about your privacy. By posting, you are declaring that you understand this policy:
- Your name, rating, website address, town, country, state and comment will be publicly displayed if entered.
- Aside from the data entered into these form fields, other stored data about your comment will include:
- Your IP address (not displayed)
- The time/date of your submission (displayed)
- Your email address will not be shared. It is collected for only two reasons:
- Administrative purposes, should a need to contact you arise.
- To inform you of new comments, should you subscribe to receive notifications.
- A cookie may be set on your computer. This is used to remember your inputs. It will expire by itself.
This policy is subject to change at any time and without notice.
These terms and conditions contain rules about posting comments. By submitting a comment, you are declaring that you agree with these rules:
- Although the administrator will attempt to moderate comments, it is impossible for every comment to have been moderated at any given time.
- You acknowledge that all comments express the views and opinions of the original author and not those of the administrator.
- You agree not to post any material which is knowingly false, obscene, hateful, threatening, harassing or invasive of a person's privacy.
- The administrator has the right to edit, move or remove any comment for any reason and without notice.
Failure to comply with these rules may result in being banned from submitting further comments.
These terms and conditions are subject to change at any time and without notice.
- Data Science
- Android
- React Native
- AJAX
- ASP.net
- C
- C++
- C#
- Cocoa
- Cloud Computing
- HTML5
- Java
- Javascript
- JSF
- JSP
- J2ME
- Java Beans
- EJB
- JDBC
- Linux
- Mac OS X
- iPhone
- MySQL
- Office 365
- Perl
- PHP
- Python
- Ruby
- VB.net
- Hibernate
- Struts
- SAP
- Trends
- Tech Reviews
- WebServices
- XML
- Certification
- Interview
categories
Related Tutorials
Send push notifications using Expo tokens in PHP
PHP convert string to lower case
A Basic Example using PHP in AWS (Amazon Web Services)
Different versions of PHP - History and evolution of PHP
PHP code to write to a CSV file for Microsoft Applications
PHP code to write to a CSV file from MySQL query
PHP code to import from CSV file to MySQL
Password must include both numeric and alphabetic characters - Magento
Resume or Pause File Uploads in PHP
PHP file upload prompts authentication for anonymous users
PHP file upload with IIS on windows XP/2000 etc
Comments