array ( 0 => 'index.php', 1 => 'PHP Manual', ), 'head' => array ( 0 => 'UTF-8', 1 => 'de', ), 'this' => array ( 0 => 'function.hash-equals.php', 1 => 'hash_equals', 2 => 'Timing attack safe string comparison', ), 'up' => array ( 0 => 'ref.hash.php', 1 => 'Hash-Funktionen', ), 'prev' => array ( 0 => 'function.hash-copy.php', 1 => 'hash_copy', ), 'next' => array ( 0 => 'function.hash-file.php', 1 => 'hash_file', ), 'alternatives' => array ( ), 'source' => array ( 'lang' => 'en', 'path' => 'reference/hash/functions/hash-equals.xml', ), 'history' => array ( ), ); $setup["toc"] = $TOC; $setup["toc_deprecated"] = $TOC_DEPRECATED; $setup["parents"] = $PARENTS; manual_setup($setup); contributors($setup); ?>

hash_equals

(PHP 5 >= 5.6.0, PHP 7, PHP 8)

hash_equals — Timing attack safe string comparison

Beschreibung

hash_equals(#[\SensitiveParameter] string $known_string, #[\SensitiveParameter] string $user_string): bool

Checks whether two strings are equal without leaking information about the contents of known_string via the execution time.

This function can be used to mitigate timing attacks. Performing a regular comparison with === will take more or less time to execute depending on whether the two values are different or not and at which position the first difference can be found, thus leaking information about the contents of the secret known_string.

Achtung

It is important to provide the user-supplied string as the second parameter, rather than the first.

Parameter-Liste

known_string

The known String that must be kept secret.

user_string

The user-supplied String to compare against.

Rückgabewerte

Returns true when the two strings are equal, false otherwise.

Beispiele

Beispiel #1 hash_equals() example

<?php
$secretKey = '8uRhAeH89naXfFXKGOEj';

// Value and signature are provided by the user, e.g. within the URL
// and retrieved using $_GET.
$value = 'username=rasmuslerdorf';
$signature = '8c35009d3b50caf7f5d2c1e031842e6b7823a1bb781d33c5237cd27b57b5f327';

if (hash_equals(hash_hmac('sha256', $value, $secretKey), $signature)) {
echo "The value is correctly signed.", PHP_EOL;
} else {
echo "The value was tampered with.", PHP_EOL;
}
?>

Das oben gezeigte Beispiel erzeugt folgende Ausgabe:

The value is correctly signed.

Anmerkungen

Hinweis:

Both arguments must be of the same length to be compared successfully. When arguments of differing length are supplied, false is returned immediately and the length of the known string may be leaked in case of a timing attack.

Siehe auch