ID: 25177
User updated by: a dot lunkeit at signcubes dot com
Reported By: a dot lunkeit at signcubes dot com
Status: Open
Bug Type: *Encryption and hash functions
Operating System: Linux
PHP Version: 4.3.2
New Comment:

Here is the Testcontainer

VERSION:VERSION 1.0
TYPE:OL_PAYMENT
CERTIFICATE:MV8wGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHAT AeBgkqhkiG9w0BCQUxERgPMjAwMzA4MjAxNTA3MDZaMCMGCSqG SIb3DQEJBDEWBBThpbsOy9VEAPvp64X3gyREhZBK7w==
PKCS7:MIIH6QYJKoZIhvcNAQcCoIIH2jCCB9YCAQExCzAJBgUr DgMCGgUAMIICSgYJKoZIhvcNAQcBoIICOwSCAjdTaG9wLUlkOj EyMzQ1Njc4DQpUcmFuc2FrdGlvbnMtSWQ6MTA2MTM5OTA0Nw0K VHJhbnNha3Rpb25zLVR5cDoxMCAoUmVzZXJ2YXRpb24pDQpCZX RyYWc6Mi41MA0KV
RocnVuZzpFVVINCldhcmVua29yYjoNCj09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT 0NCklocmUgQXJ0aWtlbDogDQo9PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09DQoxIF Rhc3NlbiBkZXIgU29ydGUgMQ0KDQo9PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09DQ pHZXNhbXRiZXRyYWc6IDIuNTAgRXVybw0KPT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT 09PQ0KDQpLYXJ0ZW5pbmhhYmVyOiBNaWNoYWVsIEdlaHJrZQ0K S3VuZGVudW1tZXI6IDg5NDkwMTcyMzAwMDAxNDM0OTkNCktyZW RpdGthcnRlbi1OdW1tZXI6IDAxMjM0NTY3ODkNCkFibGF1Zmph aHIgZGVyIEtyZWRpdGthcnRlOiAyMDA2DQpBYmxhdWZtb25hdC BkZXIgS3JlZGl0a2FydGU6IDEyDQqgggP6MIID9jCCA1
gAwIBAgIEL64
GzANBgkqhkiG9w0BAQUFADBnMQswCQYDVQQGEwJERTEcMBoGA1 UEChQTRGV1dHNjaGUgVGVsZWtvbSBBRzEQMA4GA1UECxQHVGVs ZVNlYzEoMAwGBwKCBgEKBxQTATEwGAYDVQQDFBFTaWdHIFRlc3 QgQ0EgNjpQTjAeFw0wMzA3MTcwODQ5MjRaFw0wNjA3MTcwODQ5 MjRaMEwxCzAJBgNVBAYTAkRFMRcwFQYDVQQKDA5TaWduQ3ViZX MgR21iSDEYMBYGA1UEAwwPR2VocmtlLCBNaWNoYWVsMQowCAYD VQQFEwExMIGhMA0GCSqGSIb3DQEBAQUAA4GPADCBiwKBgQCNxj 6tNW3VzYCXOkgTQCuRoqPUbokOnWUCozNoFMT26lwaSbApKWL4 FS4M
urXRJS/woltuCXZp3lxnQVA1eR/oMglYIURoKM7Xx1YP7mRKPUvecLLWjaWNPg9rzvg9kqcwjwlKx lMx6H1regWhsooBjucqg6G6NeDi2TJfxuhRQIFAMAAAAGjggHG MIIBwjAfBgNVHSMEGDAWgBTBgtADwJaxh
3T5AeVkxyIXmcqQDCB6AYDVR0fBIHgMIHdMIHaoGqgaIY1bGRh cDovL3Brc2xkYXAudHR0Yy5kZTozODkvbz1EZXV0c2NoZSBUZW xla29tIEFHLGM9ZGWGL2h0dHA6Ly93d3cudHR0Yy5kZS90ZWxl c2VjL3NlcnZsZXQvZG93bmxvYWRfY3JsomykajBoMQswCQYDVQ QGEwJERTEcMBoGA1UEChQTRGV1dHNjaGUgVGVsZWtvbSBBRzE7 MAwGBwKCBgEKBxQTATEwKwYDVQQDFCRUZWxlU2VjIERpcmVjdG 9yeSBTZXJ2aWNlIFNpZ0cgMTA6UE4wGAYIKwYBBQUHAQMEDDAK MAgGBgQAjkYBATAdBgNVHQ4EFgQUjk1Pj5ro/5o8aepB877Z9eEBUtowDgYDVR0PAQH/BAQDAgZAMBIGA1UdIAQLMAkwBwYFKyQIAQEwIQYDVR0RBBowGI EWbS5nZWhya2VAc2lnbmN1YmVzLmNvbTA0BggrBgEFBQcBAQQo MCYwJAYIKwYBBQUHMAGGGGh0dHA6Ly93d3cudHR0Yy5kZS9vY3 NwcjANBgkqhkiG9w0BAQUFAAOBgQA6M2/12adZO8U7V3KRcpKKgnIUubGt8kjbxYwLZ765LFXiazqM77ITX uwCvZNRpuAN4PiG9evIbbJ0At9yslXDFJmmcESkxblj5Ln8m4f x8EG0MC80lSITJMI8JWnC25P2lPqV2SxXZuzv43xWRyqImtGMm 5V/RazuUO
G2oBDATGCAXYwggFyAgEBMG8wZzELMAkGA1UEBhMCREUxHDAaB gNVBAoUE0RldXRzY2hlIFRlbGVrb20gQUcxEDAOBgNVBAsUB1R lbGVTZWMxKDAMBgcCggYBCgcUEwExMBgGA1UEAxQRU2lnRyBUZ XN0IENBIDY6UE4CBC
uPhswCQYFKw4DAhoFAKBfMBgGCSqGSIb3DQEJAzELBgkqhkiG9 w0BBwEwHgYJKoZIhvcNAQkFMREYDzIwMDMwODIwMTUwNzA2WjA jBgkqhkiG9w0BCQQxFgQU4aW7DsvVRAD76euF94MkRIWQSu8wD QYJKoZIhvcNAQEFBQAEgYB5sVMxPutMCBCx4JHcrTwrUUlSrQ3 rF5kTP8m889llRgHs45jviZ/H5YE0vUIWK
3YiaRn7Bwz0VhHXV4OmpjHvZQtZYBj t
GhF8kS0SDRYH50PEOyLwoWNTJWgyKa4D2sJLrdEWlB/guSYjboG9zvzReyqNgIWa4P3EM3U2uOA==
CUSTNUM:8949017230000143499
SHOP_ID:12345678
TRANS_ID:1061399047
TRANS_ART:10
AMMOUNT:2.50
CURRENCY:EUR
CREDITCARD:0123456789
EXP_MONTH:12
EXP_YEAR:2006
HASH:973a24bd0bb33edd7d4bc59a735264b0e7db1f8f

The data is taken until the Hash Field starts. The appended
to this block contains the original hash computed in C++. Please note,
that the lines are separated by CRLF (0x0d, 0x0a).


Previous Comments:
------------------------------------------------------------------------

[2003-08-20 09:34:51] a dot lunkeit at signcubes dot com

Now i found out, that the data can be smaller. I took some data greater
than 512 Bytes and the bug also appears. With data smaller than 512
Bytes it will not appear.
I will generate some vectors for you within next half hour.

------------------------------------------------------------------------

[2003-08-20 08:29:56] [email]derick@php.net[/email]

Can you point me to some of the reference test vectors?

------------------------------------------------------------------------

[2003-08-20 08:22:11] a dot lunkeit at signcubes dot com

Description:
------------
I noticed, that the sha1 function computes wrong hash values for data
with a volume greater than 2kB.

My reference values are various free implementations in C++, which come
to the same hash value, but the PHP implementation differs.

With data smaller than 2kB the problem does not exist.



Reproduce code:
---------------
This can be any code using the sha1 function. My code example doesn't
really matter.



------------------------------------------------------------------------


--
Edit this bug report at [url]http://bugs.php.net/?id=25177&edit=1[/url]