Bug #81473 [NEW]: hash_pbkdf2 truncate in hex
| From: | php at wfuchs dot de | Date: | Fri, 24 Sep 2021 09:04:59 +0000 |
| Subject: | Bug #81473 [NEW]: hash_pbkdf2 truncate in hex | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-236810@lists.php.net to get a copy of this message | ||
From: php at wfuchs dot de
Operating system: Linux
PHP version: 8.0.11
Package: hash related
Bug Type: Bug
Bug description:hash_pbkdf2 truncate in hex
Description:
------------
Tested Versions:
PHP 8.0.11 (cli) (built: Sep 23 2021 21:26:24)
PHP 7.4.24 (cli) (built: Sep 23 2021 21:36:11)
Compiled by OndÅej Surý for Ubuntu 20.04
In the PHP function "hash_pbkdf2" the key is truncated in hex (default).
With a length of 64 bytes it should be 128 hexits and not 64 hexits.
If the key is generated binary and converted to hex the length is
correct with 128 hexits.
Test script:
---------------
<?php
$algo = "sha256";
$password = "Sâ¬cur@PäÃw#rd";
$salt = random_bytes(16);
$iterations = 10000;
$binhash = hash_pbkdf2($algo, $password, $salt, $iterations, 64, TRUE);
echo ("Converted to HEX:" . PHP_EOL);
var_dump(bin2hex($binhash));
$hexhash = hash_pbkdf2($algo, $password, $salt, $iterations, 64);
echo ("HEX generated:" . PHP_EOL);
var_dump($hexhash);
?>
Expected result:
----------------
Converted to HEX:
string(128)
"b94864e32adfd58bd9324ed058ed3c40e0134f98af8abde2535576bab28ddd3e3c205381c33a705f63d75db4c340ccec288985f9ff1b917c53b419ee166083d0"
HEX generated:
string(128)
"b94864e32adfd58bd9324ed058ed3c40e0134f98af8abde2535576bab28ddd3e3c205381c33a705f63d75db4c340ccec288985f9ff1b917c53b419ee166083d0"
Actual result:
--------------
Converted to HEX:
string(128)
"b94864e32adfd58bd9324ed058ed3c40e0134f98af8abde2535576bab28ddd3e3c205381c33a705f63d75db4c340ccec288985f9ff1b917c53b419ee166083d0"
HEX generated:
string(64)
"b94864e32adfd58bd9324ed058ed3c40e0134f98af8abde2535576bab28ddd3e"
--
Edit bug report at https://bugs.php.net/bug.php?id=81473&edit=1
--
Fix committed: https://bugs.php.net/fix.php?id=81473&r=fixed
Fixed in release: https://bugs.php.net/fix.php?id=81473&r=alreadyfixed
Need backtrace: https://bugs.php.net/fix.php?id=81473&r=needtrace
Need Reproduce Script: https://bugs.php.net/fix.php?id=81473&r=needscript
Try newer version: https://bugs.php.net/fix.php?id=81473&r=oldversion
Not developer issue: https://bugs.php.net/fix.php?id=81473&r=support
Expected behavior: https://bugs.php.net/fix.php?id=81473&r=notwrong
Not enough info: https://bugs.php.net/fix.php?id=81473&r=notenoughinfo
Submitted twice: https://bugs.php.net/fix.php?id=81473&r=submittedtwice
register_globals: https://bugs.php.net/fix.php?id=81473&r=globals
PHP version support discontinued: https://bugs.php.net/fix.php?id=81473&r=phptooold
Daylight Savings: https://bugs.php.net/fix.php?id=81473&r=dst
IIS Stability: https://bugs.php.net/fix.php?id=81473&r=isapi
Install GNU Sed: https://bugs.php.net/fix.php?id=81473&r=gnused
Floating point limitations: https://bugs.php.net/fix.php?id=81473&r=float
No Zend Extensions: https://bugs.php.net/fix.php?id=81473&r=nozend
MySQL Configuration Error: https://bugs.php.net/fix.php?id=81473&r=mysqlcfg