PHP: mhash - Manual

mhash

marcel446 at yahoo dot com
06-Jun-2005 04:15


Just in case you did not observe, the function of Lance is independent of hash fuction used to get HMAC , so if one use sha1() function from php instead md5() will get sha1 HMAC.

Just try .

Thanks again Lance

robbie [at] averill [dot] co [dot] nz
18-Mar-2005 05:17


This confused me a bit when I first read the documetation for mhash. The functions that accept a hash accept them as an INTEGER not a STRING. In this case, MHASH_MD5 = 1. It is a constant, not a string.



Just thought I'd point that out, so if anyone is confused they can read that. That's the use of mhash_get_hash_name(). You input the constant (which is an integer) and it returns the hash name.

fernan at ispwest dot com
02-Nov-2004 12:03


Thanks a lot to Lance for showing how to create mhash without installing the perl extension for mhash.



I have been asking my webhosting administrator to recompile Perl with mhash extension, but do not want to do it. As a result, our company can't get credit card authorization because they require fingerprint which uses the function mhash. Now, it's working fine.



Thanks a lot, Lance.....



Fernan

jerry d0t wilborn at fast d0t net
02-Jul-2004 09:36


in responce to lance's post:



the function comes back with a hex representation of the hmac, if you wish to convert to what mhash returns natively (binary) use:  pack("H*", hmac(variables...));

lance_rushing at hot* spamfree *mail dot com
09-Jul-2003 05:02


Don't forget php has two built in hashing algorithms:



md5(), and sha1()



So if you are using: mhash(MHASH_MD5, $str) or mhash(MHASH_SHA1, $str) you could use md5($str) or sha1($str).



** But remember that md5() and sha1() produce HEX output while mhash() produces a BIN output.  So:



md5($str) == bin2hex(mhash(MHASH_MD5, $str))

sha1($str) == bin2hex(mhash(MHASH_SHA1, $str))



AND



pack("H*", md5($str)) == mhash(MHASH_MD5, $str)

pack("H*", sha1($str)) == mhash(MHASH_SHA1, $str)



(Just remember to pack() or bin2hex() your output to get the output you need)



-Lance

lance_rushing at hot* spamfree *mail dot com
27-Nov-2002 08:36


Want to Create a md5 HMAC, but don't have hmash installed?



Use this:



function hmac ($key, $data)

{

    // RFC 2104 HMAC implementation for php.

    // Creates an md5 HMAC.

    // Eliminates the need to install mhash to compute a HMAC

    // Hacked by Lance Rushing



    $b = 64; // byte length for md5

    if (strlen($key) > $b) {

        $key = pack("H*",md5($key));

    }

    $key  = str_pad($key, $b, chr(0x00));

    $ipad = str_pad('', $b, chr(0x36));

    $opad = str_pad('', $b, chr(0x5c));

    $k_ipad = $key ^ $ipad ;

    $k_opad = $key ^ $opad;



    return md5($k_opad  . pack("H*",md5($k_ipad . $data)));

}



-----

To test:

Run this on a server _with_ mhash installed:



$key = 'Jefe';

$data = "what do ya want for nothing?";

echo hmac($key, $data);

echo "&lt;br&gt;\n";

echo bin2hex (mhash(MHASH_MD5, $data, $key));



should produce:



750c783e6ab0b503eaa86e310a5db738

750c783e6ab0b503eaa86e310a5db738



Happy hashing.

shimon_d at hotmail dot com
22-Aug-2002 12:05


password security:

when you hash passwords to save them in cookie , url ,etc' my sugsession is to hash them with date 

becouse of evry body can view server log or any other loged info and reuse the hash



ie.: to re call a url eg. admin.php?user=root&passhash=5rft346tert

in this example the password keepped in secret but what stopping me to reuse the url



hash("secret") // bad security

hash("secret".date("Ymg")) // better security

// the hash good only for today

luc at 2113 dot ch
28-Dec-2001 05:42


Netscape messaging / directory server 4+ uses SHA-1 


to store password in the ldap database (slapd).


The password is first SHA-1 hashed then base64 encoded:





$pwd = "secret";


$hash = "{SHA}".base64_encode( mHash(MHASH_SHA1, $pwd));


echo "Hash: ". $hash ;

paulj at 5emedia dot net
06-Dec-2001 10:02


Many digest algorithms (especially MD5) are less secure if you are hashing data that is smaller than the algorithm's output.  I recommend either hashing a secret key/salt with the original data to increase it's security.

braben at teleline.es
12-May-2001 01:41


If you are going to use only MD5 sums, it would be a good idea to use the internal's PHP function md5() ir order to avoid the library dependence.

02-May-2001 01:02


Using RedHat 7.1, after compile/install, I had to add the line 





/usr/local/lib 





to /etc/ld.so.conf and run ldconfig to make this work.

mhash

Description