PHP: mhash - Manual

downloads | documentation | faq | getting help | mailing lists | reporting bugs | php.net sites | links | conferences | my php.net

search for in the

Mimetype mhash_keygen_s2k

Last updated: Fri, 26 Jan 2007

view this page in

# mhash

(PHP 3 >= 3.0.9, PHP 4, PHP 5)

mhash -- Compute hash

## Описание

string mhash ( int hash, string data [, string key] )

mhash() applies a hash function specified by `hash` to the `data`.

## Список параметров

`hash`

  The hash id. One of the `MHASH_XXX` constants.

`data`

  The user input, as a string.

`key`

  If specified, the function will return the resulting HMAC instead. HMAC is keyed hashing for message authentication, or simply a message digest that depends on the specified key. Not all algorithms supported in mhash can be used in HMAC mode.

## Возвращаемые значения

Returns the resulting hash (also called digest) or HMAC as a string, or `FALSE` on errors.

add a note User Contributed Notes
mhash
numien(at)deathwyrm(dot)com
31-Jan-2007 05:21
`---Quote---
pack("H*", md5($str)) == mhash(MHASH_MD5, $str)
pack("H*", sha1($str)) == mhash(MHASH_SHA1, $str)
---/Quote---
That's an awfully inefficient way of doing things. You can just put ", true" after md5 or sha1 to get binary output instead of having it convert it to hex then back.
Easier way:
md5($str, true) == mhash(MHASH_MD5, $str)
sha1($str, true) == mhash(MHASH_SHA1, $str)`
marcel446 at yahoo dot com
06-Jun-2005 04:15
`Just in case you did not observe, the function of Lance is independent of hash fuction used to get HMAC , so if one use sha1() function from php instead md5() will get sha1 HMAC.
Just try .
Thanks again Lance`
robbie [at] averill [dot] co [dot] nz
18-Mar-2005 05:17
`This confused me a bit when I first read the documetation for mhash. The functions that accept a hash accept them as an INTEGER not a STRING. In this case, MHASH_MD5 = 1. It is a constant, not a string.
Just thought I'd point that out, so if anyone is confused they can read that. That's the use of mhash_get_hash_name(). You input the constant (which is an integer) and it returns the hash name.`
fernan at ispwest dot com
02-Nov-2004 12:03
`Thanks a lot to Lance for showing how to create mhash without installing the perl extension for mhash.
I have been asking my webhosting administrator to recompile Perl with mhash extension, but do not want to do it. As a result, our company can't get credit card authorization because they require fingerprint which uses the function mhash. Now, it's working fine.
Thanks a lot, Lance.....
Fernan`
jerry d0t wilborn at fast d0t net
02-Jul-2004 09:36
`in responce to lance's post:
the function comes back with a hex representation of the hmac, if you wish to convert to what mhash returns natively (binary) use: pack("H*", hmac(variables...));`
lance_rushing at hot* spamfree *mail dot com
09-Jul-2003 05:02
`Don't forget php has two built in hashing algorithms:
md5(), and sha1()
So if you are using: mhash(MHASH_MD5, $str) or mhash(MHASH_SHA1, $str) you could use md5($str) or sha1($str).
** But remember that md5() and sha1() produce HEX output while mhash() produces a BIN output. So:
md5($str) == bin2hex(mhash(MHASH_MD5, $str))
sha1($str) == bin2hex(mhash(MHASH_SHA1, $str))
AND
pack("H*", md5($str)) == mhash(MHASH_MD5, $str)
pack("H*", sha1($str)) == mhash(MHASH_SHA1, $str)
(Just remember to pack() or bin2hex() your output to get the output you need)
-Lance`
lance_rushing at hot* spamfree *mail dot com
27-Nov-2002 08:36
`Want to Create a md5 HMAC, but don't have hmash installed?
Use this:
function hmac ($key, $data)
{
// RFC 2104 HMAC implementation for php.
// Creates an md5 HMAC.
// Eliminates the need to install mhash to compute a HMAC
// Hacked by Lance Rushing
$b = 64; // byte length for md5
if (strlen($key) > $b) {
$key = pack("H*",md5($key));
}
$key = str_pad($key, $b, chr(0x00));
$ipad = str_pad('', $b, chr(0x36));
$opad = str_pad('', $b, chr(0x5c));
$k_ipad = $key ^ $ipad ;
$k_opad = $key ^ $opad;
return md5($k_opad . pack("H*",md5($k_ipad . $data)));
}
-----
To test:
Run this on a server _with_ mhash installed:
$key = 'Jefe';
$data = "what do ya want for nothing?";
echo hmac($key, $data);
echo "&lt;br&gt;\n";
echo bin2hex (mhash(MHASH_MD5, $data, $key));
should produce:
750c783e6ab0b503eaa86e310a5db738
750c783e6ab0b503eaa86e310a5db738
Happy hashing.`
shimon_d at hotmail dot com
22-Aug-2002 12:05
`password security:
when you hash passwords to save them in cookie , url ,etc' my sugsession is to hash them with date
becouse of evry body can view server log or any other loged info and reuse the hash
ie.: to re call a url eg. admin.php?user=root&passhash=5rft346tert
in this example the password keepped in secret but what stopping me to reuse the url
hash("secret") // bad security
hash("secret".date("Ymg")) // better security
// the hash good only for today`
luc at 2113 dot ch
28-Dec-2001 05:42
`Netscape messaging / directory server 4+ uses SHA-1
to store password in the ldap database (slapd).
The password is first SHA-1 hashed then base64 encoded:
$pwd = "secret";
$hash = "{SHA}".base64_encode( mHash(MHASH_SHA1, $pwd));
echo "Hash: ". $hash ;`
paulj at 5emedia dot net
06-Dec-2001 10:02
`Many digest algorithms (especially MD5) are less secure if you are hashing data that is smaller than the algorithm's output. I recommend either hashing a secret key/salt with the original data to increase it's security.`
braben at teleline.es
12-May-2001 01:41
`If you are going to use only MD5 sums, it would be a good idea to use the internal's PHP function md5() ir order to avoid the library dependence.`
02-May-2001 01:02
`Using RedHat 7.1, after compile/install, I had to add the line
/usr/local/lib
to /etc/ld.so.conf and run ldconfig to make this work.`
add a note
Mimetype mhash_keygen_s2k

Last updated: Fri, 26 Jan 2007
show source | credits | stats | sitemap | contact | advertising | mirror sites
Copyright © 2001-2007 The PHP Group
All rights reserved.
This mirror generously provided by: Yahoo! Inc.
Last updated: Sat Mar 10 09:32:46 2007 PST