Re: RFC: Message digest hashing and HMAC classes

--- Arnaud Limbourg <arnaud.limbourg@club-internet.fr> wrote: > +1. One down, four more to go ;-) > > As to the name ... I know. Perhaps 'Message' instead of 'Digest', so we have Message/Hash and Message/HMAC classes. If you are testing it, get the newer version, but as I have changed the name you will need to: first: pear uninstall Digest second: pear install http://www.scripps.edu/~jesusmc/stuff/Message-0.0.1.tgz BTW, a nice way of using the HMAC digests is when we want to do data integrity validation, e.g.: 1) Use the SHA1 HMAC to create a token from a password (which comes from a client and thus cannot be trusted), and a private key value set for our server. Compare that with the previously stored one. Usuallly better than using as hashing function alone (see RFC 2104 for more on HMACs). 2) Use the session ID and the server key to sign forms when they are created (a hidden field will do). On submission we check 2 things, one that the session is valid (i.e. has not timed out) and that the form HMAC signature is valid. This avoids automatic submissions to forms from robots. If one is really paranoid, the HMAC for the form can be stored somewhere along with a flag indicating that it has not been submitted, that will prevent multiple submissions. Perhaps even with a timestamp for the form signature so we can timeout submissions. 3) General signing of data being passed via GET string in the URL (which can be easily spoofed). This will work w/ or w/o sessions. We have 4 things that can be changed to generate an HMAC, 2 strong (1 and 2) and 2 weak (3 and 4): a) the hashing algorithm used b) the server key c) the data serialization method: none, use serialize(), wddx, the last two are useful when we want to sign non-scalar data d) the output encoding (binary, hexadecimal, base64) Any more comments, ideas, criticisms, zen koans? > > > I was playing with the mhash lib (just installed it), and as luck will have > it > > I got the September issue of the "Linux Magazine", read the articles, hit > > google, etc. > > > > To make a long story short, I made some simple wrappers that use the mhash > > functions to generate message digests (aka hashes), as well as HMACs. > > > > Take a look at the code at: > > > > http://www.scripps.edu/~jesusmc/stuff/Digest-0.0.1.tgz > > > > That code is barely commented, but it is simple enough so it may not need > to be > > for now. The main class is the Digest class, and can be used to generate > hash > > or HMAC objects, or can be used via call to its static methods. > > > > For those who like the cool pear installer (like I do), use: > > > > pear install > > http://www.scripps.edu/~jesusmc/stuff/Digest-0.0.1.tgz > > > > You can see some examples of use in the file: > > > > Digest/misc/testdigest.php > > > > You'll find in the 'misc' dir a simple class to generate all the wrappers > for > > the hashes. I tested the code w/ mhash 0.8.16. > > > > If there is interest I'll put the package in PEAR. Name suggestions for > classes > > (as well as for methods) are welcomed. > > > > > > > > ===== > > --- Jesus M. Castagnetto (jcastagnetto@yahoo.com) > > > > Research: > > http://metallo.scripps.edu/ > > Personal: http://www.castagnetto.org/ > > > > __________________________________________________ > > Do you Yahoo!? > > New DSL Internet Access from SBC & Yahoo! > > http://sbc.yahoo.com > > > > -- > > PEAR Development Mailing List (http://pear.php.net/) > > To unsubscribe, visit: http://www.php.net/unsub.php > > ===== --- Jesus M. Castagnetto (jcastagnetto@yahoo.com) Research: http://metallo.scripps.edu/ Personal: http://www.castagnetto.org/ __________________________________________________ Do you Yahoo!? New DSL Internet Access from SBC & Yahoo! http://sbc.yahoo.com