PHP Security and Encryption Verifying Data with Hashes

PHP Security and Encryption 

Verifying Data with Hashes

Problem

You want to make sure users don’t alter data you’ve sent them in a cookie or form element.

Solution

Along with the data, send a “message digest” hash of the data that uses a salt. When you receive the data back, compute the hash of the received value with the same salt. If they don’t match, the user has altered the data.

Here’s how to generate a hash in a hidden form field:

       <?php

       /* Define a salt. */

       define('SALT', 'flyingturtle');

       $id = 1337;

       $idcheck = hash_hmac('sha1', $id, SALT);

       ?>

       <input type="hidden" name="id" value="<?php echo $id; ?>" />

       <input type="hidden" name="idcheck" value="<?php echo $idcheck; ?>" />

Here’s how to verify the hidden form field data when it’s submitted:

       /* Initialize an array for filtered data. */

       $clean = array();

       /* Define a salt. */

       define('SALT', 'flyingturtle');

       if (hash_hmac('sha1', $_POST['id'], SALT) === $_POST['idcheck']) {

            $clean['id'] = $_POST['id'];

       } else {

            /* Error */

       }

Discussion

When processing the submitted form data, compute the hash of the submitted value of $_POST['id'] with the same salt. If it matches $_POST['idcheck'], the value of $_POST['id'] has not been altered by the user. If the values don’t match, you know that the value of $_POST['id'] you received is not the same as the one you sent.

To use the same hashing technique with a cookie, add it to the cookie value with im plode():

       /* Define a salt. */

       define('SALT', 'flyingturtle');

       $name = 'Ellen';

       $namecheck = hash_hmac('sha1', $name, SALT);

       setcookie('name', implode('|',array($name, $namecheck)));

Parse the hash from the cookie value with explode():

       /* Define a salt. */

       define('SALT', 'flyingturtle');

       list($cookie_value, $cookie_check) = explode('|', $_COOKIE['name'], 2);

       if (hash_hmac('sha1', $cookie_value, SALT) === $cookie_check) {

            $clean['name'] = $cookie_value;

       } else {

            /* Error */

       }

Using a data verification hash in a form or cookie obviously depends on the salt used in hash computation. If a malicious user discovers your salt, the hash offers no protection. Besides guarding the salt zealously, changing it frequently is a good idea. For an additional layer of protection, use different salts, choosing the specific salt to use in the hash based on some property of the $id value (10 different words selected by $id%10, for example). That way, the damage is slightly mitigated if one of the words is compromised.