PHP和爪REST客戶端之間的哈希不相似

Question

我正在構建一個HMAC API，並且我有用爪測試哈希的問題。

在爪子我有這樣的有效載荷：

GET:/hello/world:"":9a6e30f2016370b6f2dcfb6880501d7f2305d69bout 

和一個自定義的HMAC-SHA256變量（實際運作like this設置它在X-哈希頭

X-Hash: 4Cq2yehWumDcUk1dYyfhm6qWjJVBkOCB8o12f5l0WGE= 

在我的PHP API。我有同樣的事情：

GET:/hello/world:"":9a6e30f2016370b6f2dcfb6880501d7f2305d69bout 

和使用：

hash_hmac('sha256', $this->getPayload(), '9a6e30f2016370b6f2dcfb6880501d7f2305d69bout', false); 

所以比較哈希值時：

Paw: 4Cq2yehWumDcUk1dYyfhm6qWjJVBkOCB8o12f5l0WGE= 
PHP: 6961b9d1f6e986c49d963cbebd691fa68dfa59b4ce3b7f05320c2d43eae3c7c3 

他們有很大的不同。任何想法爲什麼是這樣？

更新

爪代碼：

function evaluate(context){ 
    var loc = getLocation(context.getCurrentRequest().url); 

    var payload = ""; 
    payload += context.getCurrentRequest().method + ':'; 
    payload += loc.pathname + ':'; 
    payload += JSON.stringify(context.getCurrentRequest().body) + ':'; 
    payload += "9a6e30f2016370b6f2dcfb6880501d7f2305d69bout"; // Private key 
    return payload; 
}; 

function getLocation(href) { 
    var match = href.match(/^(https?\:)\/\/(([^:\/?#]*)(?:\:([0-9]+))?)(\/[^?#]*)(\?[^#]*|)(#.*|)$/); 
    return match && { 
     protocol: match[1], 
     host: match[2], 
     hostname: match[3], 
     port: match[4], 
     pathname: match[5], 
     search: match[6], 
     hash: match[7] 
    } 
} 

PHP代碼（有很多評論）：

if (strpos(strtoupper($authHeader), 'HMAC') !== 0) { 
    echo 'out'; 
    throw new HttpForbiddenException(); 
} 
else { 
    $hmacSignature = $app->request->headers()->get('X-Hash'); 
    $publicKey = $app->request->headers()->get('X-Public'); 

    if (empty($hmacSignature) || empty($publicKey)) { 
     echo 'out2'; 
     throw new HttpForbiddenException(); 
    } 
    else { 

     $this->hmacManager->setPublicKey($publicKey); 
     print '$publickey = ' . $publicKey . '<br>'; 

     // Validate if base64_encoded or not 
     if(base64_decode($hmacSignature, true) !== FALSE) { 
      $binaryString = base64_decode($hmacSignature); 
      $hmacSignature = bin2hex($binaryString); 
      print 'decoding ' . '<br>'; 
     } 
     $this->hmacManager->setHmacSignature($hmacSignature); 
     print '$hmacSignature = ' . $hmacSignature . '<br>'; 

     $this->hmacManager->setRequestMethod($app->request->getMethod()); 
     print 'method = ' . $app->request->getMethod() . '<br>'; 
     $this->hmacManager->setRequestResourceUri($app->request->getResourceUri()); 
     print 'uri = ' . $app->request->getResourceUri() . '<br>'; 

     $requestBody = $app->request()->getBody(); 
     if (Utils::isJson($requestBody)) { 
      $requestBody = json_decode($requestBody); 
     } 
     $this->hmacManager->setRequestBody(json_encode($requestBody)); 
     print 'body = ' . json_encode($requestBody) . '<br>'; 

     print 'private key = ' . $this->hmacManager->getPrivateKey() . '<br>'; 

     $payload = ''; 
     $payload .= $this->hmacManager->getRequestMethod() . ":"; 
     $payload .= $this->hmacManager->getRequestResourceUri() . ":"; 
     $payload .= $this->hmacManager->getRequestBody() . ":"; 
     $payload .= $this->hmacManager->getPrivateKey(); 
     print 'PHP payload [' . $payload . ']'; 
     $this->hmacManager->setPayload($payload); 

     $hmacValue = $this->hmacManager->generateHmac(); 
     $isValid = $this->hmacManager->isValid($this->hmacManager->generateHmac(), $hmacSignature); 

     if ($isValid !== true) { 
      echo 'out3'; 
      throw new HttpForbiddenException(); 
     } 
    } 
} 

generateHmac從另一個類：

public function generateHmac() 
{ 
    print 'Generating HMAC' . '<br>'; 
    $algorithm = $this->getAlgorithm(); 
    print 'algo ' . $algorithm . '<br>'; 
    $privateKey = $this->getPrivateKey(); 
    print 'privk ' . $privateKey . '<br>'; 

    if (empty($algorithm)) { 
     throw new \RuntimeException('Algorithm must be set and not empty'); 
    } elseif (empty($privateKey)) { 
     throw new \RuntimeException('Private key must be set and not empty'); 
    } 

    print 'payload ' . $this->getPayload() . '<br>'; 
    $hash = hash_hmac($this->getAlgorithm(), $this->getPayload(), $this->getPrivateKey(), false); 
    print 'php hasj: ' . $hash . '<br>'; 

    return $hash; 
} 

最後，這裏是輸出報表：

$publickey = 95f97b93560f951b4cae46c86d03d9b1a81d4ae8 
decoding 
$hmacSignature = e02ab6c9e856ba60dc524d5d6327e19baa968c954190e081f28d767f99745861 

method = GET 
uri = /hello/world 
body = "" 
private key = 9a6e30f2016370b6f2dcfb6880501d7f2305d69bout 
PHP payload [GET:/hello/world:"":9a6e30f2016370b6f2dcfb6880501d7f2305d69bout] 

Generating HMAC 
algo sha256 
privk 9a6e30f2016370b6f2dcfb6880501d7f2305d69bout 
payload GET:/hello/world:"":9a6e30f2016370b6f2dcfb6880501d7f2305d69bout 
php hash: 6961b9d1f6e986c49d963cbebd691fa68dfa59b4ce3b7f05320c2d43eae3c7c3 

希望它有幫助！

Answer 1

爪子散列是base64編碼，而PHP的是十六進制。所以先解碼爪子散列：

$binary = base64_decode($pawHash); 
$hex = bin2hex($binary); 

然後將它與你自己的散列進行比較。

Answer 2

我們剛剛添加了新的Base 64 to Hex conversion dynamic values，這應該可以解決您的問題。

包裝你HMAC簽名動態值的新基地64內到十六進制一個，你會得到一個有效的十六進制簽名：

您可以在這裏安裝這個新的動態值：Base 64 to Hex Dynamic Value