Bug #81473 [Com]: hash_pbkdf2 truncate in hex
| From: | php at wfuchs dot de | Date: | Fri, 24 Sep 2021 19:14:37 +0000 |
| Subject: | Bug #81473 [Com]: hash_pbkdf2 truncate in hex | ||
| References: | 1 | Groups: | php.bugs |
| Request: | Send a blank email to php-bugs+get-236823@lists.php.net to get a copy of this message | ||
Edit report at https://bugs.php.net/bug.php?id=81473&edit=1
ID: 81473
Comment by: php at wfuchs dot de
Reported by: php at wfuchs dot de
Summary: hash_pbkdf2 truncate in hex
Status: Not a bug
Type: Bug
Package: hash related
Operating System: Linux
PHP Version: 8.0.11
Assigned To: cmb
Block user comment: N
Private report: N
New Comment:
The behavior the function describes
"if binary is false this corresponds to twice the byte-length of the derived key (as every byte
of the key is returned as two hexits)"
The length in hex should be 128 and not 64 right?
Previous Comments:
------------------------------------------------------------------------
[2021-09-24 10:15:51] cmb@php.net
This behaves as advertized[1]:
| length
|
| The length of the output string. If binary is true this
| corresponds to the byte-length of the derived key, if binary is
| false this corresponds to twice the byte-length of the derived key
| (as every byte of the key is returned as two hexits).
[1] <https://www.php.net/hash_pbkdf2>
------------------------------------------------------------------------
[2021-09-24 09:04:59] php at wfuchs dot de
Description:
------------
Tested Versions:
PHP 8.0.11 (cli) (built: Sep 23 2021 21:26:24)
PHP 7.4.24 (cli) (built: Sep 23 2021 21:36:11)
Compiled by OndÅej Surý for Ubuntu 20.04
In the PHP function "hash_pbkdf2" the key is truncated in hex (default). With a length of
64 bytes it should be 128 hexits and not 64 hexits.
If the key is generated binary and converted to hex the length is correct with 128 hexits.
Test script:
---------------
<?php
$algo = "sha256";
$password = "Sâ¬cur@PäÃw#rd";
$salt = random_bytes(16);
$iterations = 10000;
$binhash = hash_pbkdf2($algo, $password, $salt, $iterations, 64, TRUE);
echo ("Converted to HEX:" . PHP_EOL);
var_dump(bin2hex($binhash));
$hexhash = hash_pbkdf2($algo, $password, $salt, $iterations, 64);
echo ("HEX generated:" . PHP_EOL);
var_dump($hexhash);
?>
Expected result:
----------------
Converted to HEX:
string(128)
"b94864e32adfd58bd9324ed058ed3c40e0134f98af8abde2535576bab28ddd3e3c205381c33a705f63d75db4c340ccec288985f9ff1b917c53b419ee166083d0"
HEX generated:
string(128)
"b94864e32adfd58bd9324ed058ed3c40e0134f98af8abde2535576bab28ddd3e3c205381c33a705f63d75db4c340ccec288985f9ff1b917c53b419ee166083d0"
Actual result:
--------------
Converted to HEX:
string(128)
"b94864e32adfd58bd9324ed058ed3c40e0134f98af8abde2535576bab28ddd3e3c205381c33a705f63d75db4c340ccec288985f9ff1b917c53b419ee166083d0"
HEX generated:
string(64) "b94864e32adfd58bd9324ed058ed3c40e0134f98af8abde2535576bab28ddd3e"
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=81473&edit=1