Question

I’m working on a project(PHP Based) in which I need to compute SHA1, I’m using this line of code to generate SHA1 in PHP.

$da = file_get_contents("payload.txt");
echo sha1($da);

and this is the code for the .Net

private static string GetSHA1(string text)
        {
            UnicodeEncoding UE = new UnicodeEncoding();
            byte[] hashValue;
            byte[] message = UE.GetBytes(text);

            SHA1Managed hashString = new SHA1Managed();
            string hex = "";

            hashValue = hashString.ComputeHash(message);
            foreach (byte x in hashValue)
            {
                hex += String.Format("{0:x2}", x);
            }
            return hex;
        }

But I’m confused because both of languages generate different results, I’m not provide any salt in both of them(as I don’t know what to use in salt b/c the api didn’t defined that)

I also need to work on RSA after that(I’ve a key for the encryption)
Also Can anyone tell, does these algorithms differ due to languages or any thing I’m missing???

Need some experts opinion on this

this is the whole Algorithm to generate SHA1 and RSA encryption

<?php
class MyEncryption
{

    public $pubkey = '...public key here...';
    public $privkey = '...private key here...';

    public function encrypt($data)
    {
        if (openssl_private_encrypt($data, $encrypted, $this->pubkey))
            $data = base64_encode($encrypted);
        else
            throw new Exception('Unable to encrypt data. Perhaps it is bigger than the key size?');

        return $data;
    }

    public function decrypt($data)
    {
        if (openssl_private_decrypt(base64_decode($data), $decrypted, $this->privkey))
            $data = $decrypted;
        else
            $data = '';

        return $data;
    }
}

$enc = new MyEncryption();
$enc->pubkey = file_get_contents("server.key");
$payload = file_get_contents("payload1.txt");//payload1.txt contain xml data
$hashRes = sha1($payload,true);
echo $enc->encrypt($hashRes);


?>

Thanks alot

Answer 1

It’s your UnicodeEncoding. PHP doesn’t know anything about encodings, so your string simply contains all the bytes that the file does, 1:1. In .NET however, if you read the file as text, it will assume some encoding (typically UTF-8, if you don’t specify otherwise) and then converts it to the internal representation, and in the end you convert it to UTF-16 and hash those bytes – which are probably nothing like the original at bytes all, unless the original also was UTF-16. And even if it was UTF-16, it might have included the Byte-Order-Mark, which UnicodeEncoding.GetBytes() doesn’t. And even if it didn’t, the original string might not have been normalized, and you might have normalized it somewhere along the way (you don’t show us the code where you read it), and the bytes will be different again. Etc.

The correct approach would be to read the whole file as a binary block of bytes (for example, with System.IO.File.ReadAllBytes()), and then hash those bytes directly. There’s no need to involve any text encodings and conversions. And then the hashes should match.