C ++和PHP中的不同结果HMAC SHA-256

Question

I encode string to base64 and generate HMAC SHA256 with this base64 string. I encode the result of HMAC(char bytes) to base64.

I use C++: openssl library.

And got a different results in PHP and C++:

C++:

JSON: {"req_hash":"someUniqCodeHash","answer":true}

BASE64: eyJyZXFfaGFzaCI6InNvbWVVbmlxQ29kZUhhc2giLCJhbnN3ZXIiOnRydWV9

HMAC: P/p2YlxL8xdhmn+QIAlVLFDS50ai4JE/l1pMMrKZKrE=

PHP:

JSON: {"req_hash":"someUniqCodeHash","answer":true}

BASE64: eyJyZXFfaGFzaCI6InNvbWVVbmlxQ29kZUhhc2giLCJhbnN3ZXIiOnRydWV9

HMAC: P/p2YlxL8xdhmn+QIAlVLFDS50ai4JE/l1pMMrKZKrE=

And if you can see, HMAC same result !

c++: P/p2YlxL8xdhmn+QIAlVLFDS50ai4JE/l1pMMrKZKrE=

php: P/p2YlxL8xdhmn+QIAlVLFDS50ai4JE/l1pMMrKZKrE=

But, when I change JSON like this (changed true to false ) :

JSON: {"req_hash":"someUniqCodeHash","answer":false}

i got this:

C++:

JSON: {"req_hash":"someUniqCodeHash","answer":false}

BASE64: eyJyZXFfaGFzaCI6InNvbWVVbmlxQ29kZUhhc2giLCJhbnN3ZXIiOmZhbHNlfQ==

HMAC: znUOWS2MMLpjIBSpq2GfSNivaL8IUDcZXZs24D0=

PHP:

JSON: {"req_hash":"someUniqCodeHash","answer":false}

BASE64: eyJyZXFfaGFzaCI6InNvbWVVbmlxQ29kZUhhc2giLCJhbnN3ZXIiOmZhbHNlfQ==

HMAC: znUOWS2MMLpjIBSpq2GfSNivaL8IUDcZXZs24D0AHZA=

Why the HMAC result is different?

You can see:

C++: znUOWS2MMLpjIBSpq2GfSNivaL8IUDcZXZs24D0=

PHP: znUOWS2MMLpjIBSpq2GfSNivaL8IUDcZXZs24D0AHZA=

In PHP HMAC string added some chars: ...AHZA= . What is this?

And my PHP code :

 <?php
 $b = base64_encode('{"req_hash":"someUniqCodeHash","answer":false}');
 $hmac =$b.".".base64_encode(hash_hmac('sha256',$b,'eyJhZGRyZXNzX3RvIjp7JzEnOidjbGll',true));

My C++ code :

std::string sfjson = "{\"req_hash\":\"someUniqCodeHash\",\"answer\":false}";
std::cout << "JSON: " << sfjson << "\n";

std::string fencoded_data = base64_encode_str(sfjson);
std::cout << "BASE64: " << fencoded_data << "\n";

unsigned char* digest;
std::string key = "eyJhZGRyZXNzX3RvIjp7JzEnOidjbGll";

digest = HMAC(EVP_sha256(), reinterpret_cast<const unsigned char*>(key.c_str()), key.length(), reinterpret_cast<const unsigned char*>(fencoded_data.c_str()), fencoded_data.length(), NULL, NULL);

std::string sName(reinterpret_cast<char*>(digest));

std::string hmac_data = base64_encode_str(sName);

std::cout << "HMAC: " << hmac_data << "\n";

Base64 from there: https://gist.github.com/rustem-art/5f6b510c65bbbfd279386225b978f960

Answer 1

I found the solution! ;)

Never use NULL as:

digest = HMAC(EVP_sha256(),
              reinterpret_cast<const unsigned char*>(key.c_str()), key.length(),
              reinterpret_cast<const unsigned char*>(data.c_str()), data.length(),
              NULL, NULL);

Use special variable (in my code is: diglen and result) for return function.

unsigned int diglen;

unsigned char result[EVP_MAX_MD_SIZE];

digest = HMAC(EVP_sha256(),
              reinterpret_cast<const unsigned char*>(key.c_str()), key.length(),
              reinterpret_cast<const unsigned char*>(data.c_str()), data.length(),
              result, &diglen);