HMAC值在Python和PHP中不一致

Question

T am trying to use HMAC to hash a data string but for some reason my PHP and Python scripts results are not consistent... I can't figure out why.

The one that is technically working is the Python script and although I get results from PHP script, the hex returned is incorrect.

UPDATE -- one thing i'v noticed is if i am using a single line for the data then the results are identical. The mismatch seems to occur when there is multi-line data.

Python demo script here https://repl.it/BBDH/2

Result:

f54617eadc7c037b4ed484103bb21426994110a9

import hashlib
import hmac
import base64

key = b"M0u$t4fa@1Kh-Key"

csr = """-----BEGIN NEW CERTIFICATE REQUEST-----
MIICtzCCAZ8CAQAwcjELMAkGA1UEBhMCQVUxETAPBgNVBAgMCFZpY3RvcmlhMRIw
EAYDVQQHDAlNZWxib3VybmUxDzANBgNVBAoMBk1LVEVTVDELMAkGA1UECwwCSVQx
HjAcBgNVBAMMFWRuc3Rlc3QzLnNzbHRlY2hzLmNvbTCCASIwDQYJKoZIhvcNAQEB
BQADggEPADCCAQoCggEBAM1Ik2SS1F4NgizKXCqpiliR/c285HtcLKFD6OcJO6d6
v8n+1B7R1ovUqRyoM4qsLAVVHshvsuqxbD7sLmcEfh/akee+CGLqgSNSw913IBWL
WRtBRhVTd6gvTQY4KqpEgRShnua179Cbb/cQLsFhHhog/IfD0JWwdRWLqn3rzQcI
xzAsOkTJSarAt/QPS5fq1Hk978iQ0QAxtEssaX+0Xcq7ZyJGkHRyW3cBoynSQAYz
RNGBFTFB+z/qiAkKWwRs61cnKub9Grz6Adw931zuYICW0EaWdBGdc15cUkvI6RF4
xqhzmHBTZLQZDcP9vYrE/biVvX2GVNKpO1hd0i7iOTcCAwEAAaAAMA0GCSqGSIb3
DQEBCwUAA4IBAQBPmct14B0f7HkMar8Ogf1wgo7jXyFytW7tfj3exTsyBC/5ShGv
1Xx//H8I5ecb5N6EflyXmaFiWM4ybQduhVyKzNxlU8i5ug/msdpxQhj3rZ7WO6Xb
O8b5oj5e/8V1RmmsjC9dDFA/A8/JgAbrOn2CtCJrgRtl1LFBtaFRonfaRbuzcVSE
e1qdKoPY2UNK7cd3Hv/pkkorUJd89YREFZatyvU/b89fjNaPzjvtljxGadeIX5WO
7sQwMyHCSknWZPY4BYaiMf6jZ8TjXOCyIHQ3bdiDSiJlUEXvgz2yhF6Uue6aTvhR
Q85mPbtxXP+JXiZgSuT0Q6n7qN1b1mbZJgwk
-----END NEW CERTIFICATE REQUEST-----""".encode('utf-8')

hashed = hmac.new(key, csr, digestmod=hashlib.sha1).hexdigest()
print("HMAC (hex) =", hashed)

PHP demo script here https://repl.it/BBDF/2

Result:

e978d0d10b814e486592ed608b5f16d095a9affa

$key = 'M0u$t4fa@1Kh-Key';
$data = '-----BEGIN NEW CERTIFICATE REQUEST-----
MIICtzCCAZ8CAQAwcjELMAkGA1UEBhMCQVUxETAPBgNVBAgMCFZpY3RvcmlhMRIw
EAYDVQQHDAlNZWxib3VybmUxDzANBgNVBAoMBk1LVEVTVDELMAkGA1UECwwCSVQx
HjAcBgNVBAMMFWRuc3Rlc3QzLnNzbHRlY2hzLmNvbTCCASIwDQYJKoZIhvcNAQEB
BQADggEPADCCAQoCggEBAM1Ik2SS1F4NgizKXCqpiliR/c285HtcLKFD6OcJO6d6
v8n+1B7R1ovUqRyoM4qsLAVVHshvsuqxbD7sLmcEfh/akee+CGLqgSNSw913IBWL
WRtBRhVTd6gvTQY4KqpEgRShnua179Cbb/cQLsFhHhog/IfD0JWwdRWLqn3rzQcI
xzAsOkTJSarAt/QPS5fq1Hk978iQ0QAxtEssaX+0Xcq7ZyJGkHRyW3cBoynSQAYz
RNGBFTFB+z/qiAkKWwRs61cnKub9Grz6Adw931zuYICW0EaWdBGdc15cUkvI6RF4
xqhzmHBTZLQZDcP9vYrE/biVvX2GVNKpO1hd0i7iOTcCAwEAAaAAMA0GCSqGSIb3
DQEBCwUAA4IBAQBPmct14B0f7HkMar8Ogf1wgo7jXyFytW7tfj3exTsyBC/5ShGv
1Xx//H8I5ecb5N6EflyXmaFiWM4ybQduhVyKzNxlU8i5ug/msdpxQhj3rZ7WO6Xb
O8b5oj5e/8V1RmmsjC9dDFA/A8/JgAbrOn2CtCJrgRtl1LFBtaFRonfaRbuzcVSE
e1qdKoPY2UNK7cd3Hv/pkkorUJd89YREFZatyvU/b89fjNaPzjvtljxGadeIX5WO
7sQwMyHCSknWZPY4BYaiMf6jZ8TjXOCyIHQ3bdiDSiJlUEXvgz2yhF6Uue6aTvhR
Q85mPbtxXP+JXiZgSuT0Q6n7qN1b1mbZJgwk
-----END NEW CERTIFICATE REQUEST-----';
$hmac = hash_hmac('sha1', $data, $key);
echo "HMAC (hex) = ".$hmac;

Answer 1

Shevron was right: line ending are differents.

Just add: $data = str_replace("\\r\\n", "\\n", $data); before computing the hash.

Here is the corrected rept.it file. https://repl.it/BBDF/4