troubleshooting Question

How to Generate HMAC SHA256 in PHP?

Avatar of adworldmedia
adworldmediaFlag for United States of America asked on
PHPC#ASP.NET
6 Comments1 Solution5830 ViewsLast Modified:
I've coded a token generation routine in C#, that I need to convert to PHP and am having trouble.

The C# code is:
        public string GenerateToken(string username, string password, string ip, string userAgent, long ticks)
        {
            authSettings setting = getSettings();
            string hash = string.Join(":", new string[] { username, ip, userAgent, ticks.ToString() });
            string hashLeft = "";
            string hashRight = "";
            using (HMAC hmac = HMACSHA256.Create(setting.alg))
            {
                hmac.Key = Encoding.UTF8.GetBytes(GetHashedPassword(password,setting));
                hmac.ComputeHash(Encoding.UTF8.GetBytes(hash));
                hashLeft = Convert.ToBase64String(hmac.Hash);
                hashRight = string.Join(":", new string[] { username, ticks.ToString() });
            }
            string genToken = Convert.ToBase64String(Encoding.UTF8.GetBytes(string.Join(":", hashLeft, hashRight)));
            return genToken;
        }

        public string GetHashedPassword(string password, authSettings setting)
        {
            string key = string.Join(":", new string[] { password, setting.salt });
            using (HMAC hmac = HMACSHA256.Create(setting.alg))
            {
                hmac.Key = Encoding.UTF8.GetBytes(setting.salt);
                hmac.ComputeHash(Encoding.UTF8.GetBytes(key));
                return Convert.ToBase64String(hmac.Hash);
            }
        }

and the PHP code I have is:
//Define key to hash, password + salt
$key = base64_encode(hash_hmac('sha256', utf8_encode($password . ':' . $salt), utf8_encode($salt)));
echo '<b>Key:</b> ' . $key . '<br>';

//Define Message
$message = $username . ':' . $ip . ':' . $agent . ':' . $timestamp;

//Create Hash
$hash = hash_hmac('sha256', $message, $key);

//Create token
$token = base64_encode($hash);

$tokenId = $username . ':' . $timestamp;
$tokenString = $token . ':' . $tokenId;
$tokenRetVal = base64_encode($tokenString);

echo '<b>Token String:</b> ' . $tokenString . '<br>';
echo '<b><font color=red>Token:</font></b> ' . $tokenRetVal . '<br>';

The results of the idential values, are completely different.  What am I doing wrong?
ASKER CERTIFIED SOLUTION
gr8gonzo
Consultant

Our community of experts have been thoroughly vetted for their expertise and industry experience.

Join our community to see this answer!
Unlock 1 Answer and 6 Comments.
Start Free Trial
Learn from the best

Network and collaborate with thousands of CTOs, CISOs, and IT Pros rooting for you and your success.

Andrew Hancock - VMware vExpert
See if this solution works for you by signing up for a 7 day free trial.
Unlock 1 Answer and 6 Comments.
Try for 7 days

”The time we save is the biggest benefit of E-E to our team. What could take multiple guys 2 hours or more each to find is accessed in around 15 minutes on Experts Exchange.

-Mike Kapnisakis, Warner Bros