Question

I was attempting to
encrypt de cookie data with md5, but I can not validate the hash back.

It has got to do, with the fact that cookie_data is a serialized array, because normal stringvalues work ok.

It’s actually from a codeigniter class, but it does not work??
Does anyone know what the problem might be?

$hash    = substr($session, strlen($session)-32); 
$session= substr($session, 0, strlen($session)-32); 

if ($hash !==  md5($session.$this->encrypt_key))
{........

and the cookie value is encrypted like this

$cookie_data = $cookie_data.md5($cookie_data.$this->encrypt_key);

EDIT
I found that the answer is to use urlencode en urldecode in the proces of creating and validate
md5 hashes, because setcookie does urlencode automaticly, and thereby possibly changing the hash.

thanks, Richard

Answer 1

md5 is a oneway function. It is not a reversible one, so you can’t decrypt the data.

The only thing you can do is encrypt the original data (if you saved it elsewhere) and check the result of this second computation.

If the value retrieved and the new value calculated are the same, the hash you received is valid (As you are doing in your code).

EDIT

You know, with just three lines of code I will guess some possible causes:

1. $session doesn’t contains at the beginning of your code the same value of cookie_data.
2. you are using multibyte strings and strlen is not mb aware (use the idioms substr($session,0,-32) to get the payload part of the string.
3. maybe substr doesn’t cope with multibyte strings too, use explicitally mb_substr (or whatever it is called).

To me the first case is the more probable. For what I can see.