Why isn't my PHP SHA256 hash equivalent to C# SHA256Managed hash

Question

Why aren't these the same?

php:

    $hash = hash('sha256', $userData['salt'] . hash('sha256', $password) );

c#

    public static string ComputeHash(string plainText, string salt)
    {
        // Convert plain text into a byte array.
        byte[] plainTextBytes = Encoding.UTF8.GetBytes(plainText);
        byte[] saltBytes = Encoding.UTF8.GetBytes(salt);

        SHA256Managed hash = new SHA256Managed();

        // Compute hash value of salt.
        byte[] plainHash = hash.ComputeHash(plainTextBytes);

        byte[] concat = new byte[plainHash.Length + saltBytes.Length];

        System.Buffer.BlockCopy(saltBytes, 0, concat, 0, saltBytes.Length);
        System.Buffer.BlockCopy(plainHash, 0, concat, saltBytes.Length, plainHash.Length);

        byte[] tHashBytes = hash.ComputeHash(concat);

        // Convert result into a base64-encoded string.
        string hashValue = Convert.ToBase64String(tHashBytes);

        // Return the result.
        return hashValue;
    }

Because the question is flawed. It is _equivalent_. Only it doesn't _look_ the same — sehe, Aug 30 '11 at 21:31
that may be so, but I added base64_encode() and they still do not produce the same output. — Lemontongs, Aug 30 '11 at 23:01

score 11 · Accepted Answer · answered Aug 30 '11 at 21:30

11

C# is outputting a base64 ecoded string, and PHP is outputting a number in hex. A better comparison might be to pass the parameter true to the end of the hash function of PHP and base64 the result:

 $hash = base64_encode(
           hash('sha256', $userData['salt'] . hash('sha256', $password), true )
         );

answered Aug 30 '11 at 21:30

cwallenpoole

79,954
26
128
166

Thank you for you're quick response! I tried this and tho they are now closer, they do not produce the same output. Any other thoughts? – Lemontongs Aug 30 '11 at 22:59
@Lemontongs have you made any changes to the above code...I am getting a differnt result in php and c# – SHANib Apr 16 '13 at 10:30

score 3 · Answer 2 · answered Aug 30 '11 at 21:29

3

Because they're different. Your C# code encodes the computed hash in Base64 encoding at the end. PHP just returns a string of hexadecimal digits.

answered Aug 30 '11 at 21:29

Mchl

61,444
9
118
120

score 2 · Answer 3 · edited May 23 '17 at 10:30

2

First suspect:

Encoding.UTF8.GetBytes(plainText);

C# uses UTF-8, your PHP probably doesn't, but you could be lucky if you use strictly letters from the US-ASCII subset.

Second suspect:

Convert.ToBase64String(tHashBytes);

There's nothing about Base64 in your PHP.

Since PHP will give you a hex-encoded result, you should switch to Hex in your C#, too. See this answer for solutions.

edited May 23 '17 at 10:30

Community

1
1

answered Aug 30 '11 at 21:31

emboss

38,880
7
101
108

score 0 · Answer 4 · answered Aug 30 '11 at 21:30

0

Well I'm no C# programmer, but one thing that leaps out at me is this:

// Convert result into a base64-encoded string.
string hashValue = Convert.ToBase64String(tHashBytes);

Are you base64-encoding the final output in C#? Because you're not in PHP...

answered Aug 30 '11 at 21:30

DaveRandom

87,921
11
154
174

score -1 · Answer 5 · edited Nov 07 '14 at 05:19

-1

C#
string toHash = "abcdefg";
SHA256Managed hash = new SHA256Managed();
byte[] signatureData = hash.ComputeHash(new UnicodeEncoding().GetBytes(toHash));
string hashResult = System.Convert.ToBase64String(signatureData);
PHP
print base64_encode(hash("sha256",mb_convert_encoding("abcdefg","UTF-16LE"),true));

Write like top code,They are the same

edited Nov 07 '14 at 05:19

benomatis

5,536
7
36
59

answered Mar 01 '13 at 09:43

lei.liu

9
1

score -1 · Answer 6 · edited Feb 16 '20 at 15:15

-1

C#

string toHash = "abcdefg"; 
SHA256Managed hash = new SHA256Managed(); 
byte[] signatureData = hash.ComputeHash(new UnicodeEncoding().GetBytes(toHash)); 
string hashResult = System.Convert.ToBase64String(signatureData);

PHP

print base64_encode(hash("sha256",mb_convert_encoding("abcdefg","UTF-16LE"),true));

Works for me.

edited Feb 16 '20 at 15:15

Ronak Dhoot

2,322
1
12
19

answered Feb 16 '20 at 13:56

Maroun Tannous

1

Why isn't my PHP SHA256 hash equivalent to C# SHA256Managed hash

6 Answers6

Linked