MD5结果不同

Question

I am porting an application developed in Java struts to PHP, the database is in MySQL,

The PHP, MySQL or online MD5 produces this for NtbPq :

db94207ab2924504e0f590682645258a

Where as the application has produced this for same password:

db94207ab292454e0f590682645258a
              ^

Notice the missing 1 character. Now the Java application works perfectly and logs the user but PHP cannot verify and says it doesn't match with PHP md5 function.

Is there any solution I can use 31 char md5 by java to verify in PHP?

EDIT : problem is i have not developed the java application, now there are over 400 users, which i want to port in php, i dont know a thing about java, i just want to veryfy those 31 character md5 in php

Answer 1

I strongly suspect that the hex conversion you're using in the application is failing if the leading nybble of a byte is 0. This is probably because you've got hex conversion code within the application itself, rather than using a standard library.

Solution: find the hex conversion code, rip it out, and use a standard library instead. For example, as it seems by your comment that it's the Java code which is producing the wrong result (your post isn't very clear) you could use Apache Commons Codec .

As noted in comments, however, it would be worth trying to avoid using MD5 anyway. That may or may not be feasible right now, but it should be on your medium-term roadmap.

EDIT: As a temporary measure, you could write your own PHP code to emulate the brokenness. Basically, you need to perform the normal MD5 hashing, then take the hex result and remove any '0' from it which occurs in an even position. So for example "ab0120" would end up as "ab120" - because the first '0' is in position 2, but the last '0' is in position 5. Alternatively, perform the hex conversion yourself, converting one byte at a time and trimming any leading '0' character from each two-character result. This code should be removed as quickly as possible, and only used to validate that users with broken stored MD5 hashes are valid.

Answer 2

I think this could possibly help you: Java md5, the PHP way

Seems to me like the very same problem.

Answer 3

Hi what I would do is store the md5 hash in your db and whenever you detect a login of that specific user convert it to PBKDF2 (its more secure). Then you can delete the old md5.

This guide shows you how to do it.

https://crackstation.net/hashing-security.htm#javasourcecode