views:

526

answers:

4

Hi

we previously use a C#.net 2.0 to create a web app.

Users password were hashed and stored in database using the following code.

private const string encryptionKey = "AE09F72B007CAAB5";

HMACSHA1 hash = new HMACSHA1();
hash.Key = HexToByte(encryptionKey);
encodedPassword = Convert.ToBase64String(
    hash.ComputeHash(Encoding.Unicode.GetBytes(password)));

now we intend to migrate to php.

so we face a problem for users when they want to back in.

what php equivalent of the method should be used so that the hash values in the database would work?

eg password to encode is pa55w0rd the hash value gotten is oK9NOVhpTkxLoLfvh1430SFb5gw=

Thank you.

A: 

Using a .Net version of PHP (Phalanger) or using a .Net webservice to encode/decode isn't an option?

Mischa Kroon
thanks mischa, but we are looking to cut costs. hence it is more elegant if we have a php equivalent of the hash function we used in c#.anyway, thanks for leaving your answer. now i know there is such a thing as phalanger. which i previously didnt hear about.
keisimone
A: 

Try something like:

<?php
 $key = "AE09F72B007CAAB5";
 echo base64_encode(hash_hmac("sha1", "test", $key, true));
?>
hi tt, nope didn't work. i got v1tgPrd6893541ZqrDVr4F1qHw8= instead of oK9NOVhpTkxLoLfvh1430SFb5gw=
keisimone
A: 

In C# the default formatting of the hash is in HEX (AE09F72B007CAAB5 is a hex number).PHP defaults to Base64 formatting. Solving your problem is a matter of converting the base64 string to hex in php

AlexDrenea
hi alex, thanks for answering. i wanted to ask you for more details, but i got the answer i needed. thank you.
keisimone
+2  A: 
VolkerK
this works! thanks.i could have just left it like this. but i want to learn and get better at this. so help me with a few questions.// http-request where the data is utf-8 encoded. Adjust the $from parameter for// mb_convert_encoding() accordinglythe intention is to build a php login page, so i suppose it will be http request? how to tell if it is utf-8 encoding? how to adjust the encoding if at all possible?thank you once again!!
keisimone
by the way, i do know that for utf8 i need to change to $data = mb_convert_encoding($password, 'UTF-16LE', 'UTF-8'); what i meant was the http request.
keisimone
In a nutshell: If you send the html doc containing the login form utf-8 encoded you can expect the client to send the login data utf-8 encoded as well. Curious, I couldn't find a question on that topic on SO...?
VolkerK
+1 for helping me identify the cause of a similar problem
Matt Lacey