Different HMACs generated by nodejs and php

Question

// base64-encode the binary result of the HMAC computation
$merchantSig = base64_encode(hash_hmac('sha256',$signData,pack("H*" , $hmacKey),true));

The above is the php code that generates the digest.

let h = crypto.createHmac('sha256', hmacKey).update(keyString).digest('base64');

The above is the nodejs code that generates the digest. The key that I am using is hexadecimal in both php and node. What should I be doing differently in node to get the same result as that in php. I know php uses a different encoding than nodejs. But, what else am I missing here?

If you want to make a case that they are different, then you need to show example inputs and outputs. — Artjom B., Mar 28 '17 at 08:36
@ArtjomB. here is the php code: http://codepad.org/hCIM1J6a node: http://rextester.com/AEZ83950 — Karthik Priyadarshan, Mar 30 '17 at 09:59

score 1 · Answer 1 · edited May 23 '17 at 12:17

well, there are no difference between the hmac's in both php and node.js .

this is the normal behavior for the two pieces of codes your provided.

in your php you are packing your $hmacKey

the step which is not exists in your node side;

in all the next examples i will use 123456 as hmac key and yello as a data string

for example :

php without packing :

$merchantSig = base64_encode(hash_hmac('sha256',$signData, $hmacKey,true));
echo $merchantSig; // output : gKjrFq1nrRP33vGiAK9V1Z5bLX5EFZhcfy2flRIGPEI=

node.js without packing :

let h = crypto.createHmac('sha256', hmacKey).update(keyString).digest('base64');
console.log(h); // output : gKjrFq1nrRP33vGiAK9V1Z5bLX5EFZhcfy2flRIGPEI=

now let's pack the both :

php with packing :

$merchantSig = base64_encode(hash_hmac('sha256',$signData,pack("H*" , $hmacKey),true));
echo $merchantSig; // output : Y8D5crzxQfFkwQn1OJHeZTS1KVuTH0y7qLuxyetE0TY=

node.js with packing here is the trick

var h = crypto.createHmac('sha256', hmacKey.packHex()).update(keyString).digest('base64');
//                                          ^^^^^^^^^
console.log(h); // output : Y8D5crzxQfFkwQn1OJHeZTS1KVuTH0y7qLuxyetE0TY=

Update

Here is some online tests for both php & nodejs in the two cases (using pack-without using pack)

php : https://3v4l.org/HCt4g

nodejs : http://rextester.com/YNNWN69327

here is another tests with another keys and strings . for php :

https://3v4l.org/JKdNk

and node.js

http://rextester.com/RXGM49887 ,

Did you get the same output after using that 'packHex' function in the nodejs code? — Karthik Priyadarshan, Mar 29 '17 at 09:10
@KarthikPriyadarshan I've added online demos to check out both php and nodejs tests — hassan, Mar 29 '17 at 09:27
here is another tests with another keys and strings . for node.js http://rextester.com/RXGM49887 , php : https://3v4l.org/JKdNk — hassan, Mar 30 '17 at 09:57
you may need to handle it by your self , this will be better for you, I've gave you the way, you need to go on ;) — hassan, Mar 30 '17 at 11:18

Different HMACs generated by nodejs and php

1 Answers1

Update

Linked