验证 md5 base64_encode 以显示值

Question

我正在比较base64_encode md5在不同域上使用相同值（IP、时间、路径和密码）创建的两个密钥。在第一个域上创建加密密钥    $secret = "PASSWORD";    $expires = time()+3600;     $uri = '/video1/';    $ip = $_SERVER['REMOTE_ADDR'];    $md5 = base64_encode(md5($secret . $expires . $uri . $ip, true));     $md5 = strtr($md5, '+/', '-_');     $md5 = str_replace('=', '', $md5);     $rtmp = "?md5=".$md5;    $urls= 'http://example.com'.$uri .$rtmp;    echo '<a href="' . $urls . '">' .$urls . '</a>';在第二个域上创建加密密钥并与收到的 URL 密钥进行比较    function getAddress() {        $protocol = $_SERVER['HTTPS'] == 'on' ? 'https' : 'http';        return $protocol.'://'.$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI'];    }    $url = getAddress();    $path = (parse_url($url, PHP_URL_PATH));    // recive path here '/video1/'    $verify = substr(parse_url($url, PHP_URL_QUERY),4); //recive md5 encoded key from URL     /* create again md5 encoded key to match with URL key */    $secret = "PASSWORD";    $expires = time()+3600;     $uri = $path;    $ip = $_SERVER['REMOTE_ADDR'];    $md5 = base64_encode(md5($secret . $expires . $uri . $ip, true));     $md5 = strtr($md5, '+/', '-_');     $md5 = str_replace('=', '', $md5);     $rtmp = $md5;    if ($rtmp===$verify){     // Matching both, local key with URL key        echo '<h1>Welcome</h1>';    }    else {        echo '<h1>Password,Time,Path or IP Not Match</h1>';    }我在加密中使用了 time(3600)，所以if语句应该显示 3600 秒的值。但这总是显示else价值。这将如何打印if时间值（3600）？在那之后打印else

Answer 1

也许超出了问题的范围，但整个MD5方法是有缺陷的，所以为什么不去“全力以赴”（俗话说）并实际使用加密而不是问题中的散列？

的encrypt和decrypt在用于PHP手动功能是基于代码中发现openssl_encrypt

function encrypt( $data=false, $pubkey=false, $cipher='AES-128-CBC' ){

    if( !empty( $data ) && in_array( $cipher, openssl_get_cipher_methods() ) ){

        $ivlen = openssl_cipher_iv_length( $cipher );

        $iv = openssl_random_pseudo_bytes( $ivlen );

        $encrypted = openssl_encrypt( $data, $cipher, $pubkey, $options=OPENSSL_RAW_DATA, $iv );

        $hash = makehash( $encrypted, $pubkey );

        return base64_encode( $iv . $hash . $encrypted );

    }

    return false;

}

function decrypt( $data, $pubkey=false, $cipher='AES-128-CBC' ){

    if( !empty( $data ) && in_array( $cipher, openssl_get_cipher_methods() ) ){

        $shalength=32;

        $data = base64_decode( $data );

        $ivlen = openssl_cipher_iv_length( $cipher );

        $iv = substr( $data, 0, $ivlen );

        $hash = substr( $data, $ivlen, $shalength );

        $encrypted = substr( $data, $ivlen + $shalength );

        $decrypted = openssl_decrypt( $encrypted, $cipher, $pubkey, $options=OPENSSL_RAW_DATA, $iv );

        if( $decrypted && hash_equals( $hash, makehash( $encrypted, $pubkey ) ) ){

            return $decrypted;

        }

    }

    return false;

}

function makehash( $data, $key ){

    return hash_hmac( 'sha256', $data, $key, true );

}

然后，使用它：

$lifetime=3600;

$key='A complex secret string - ideally this will be the contents of an ssl cert perhaps obtained using file_get_contents etc';

$cipher='AES-128-CBC';

/* Create the payload of items to be encrypted and passed in the url */

$payload=array(

    'endpoint'  =>  '/secret-forum/topic404',

    'expires'   =>  time() + $lifetime,

    'ip'        =>  $_SERVER['REMOTE_ADDR']

);

/* create a nice string to be encrypted */

$data=urldecode( http_build_query( $payload ) );

/* create the encrypted data string */

$encrypted=encrypt( $data, $key, $cipher );

/* construct the url to be presented to the user */

$url=sprintf( '%s://%s/?hash=%s', $_SERVER['REQUEST_SCHEME'], $_SERVER['HTTP_HOST'], $encrypted );

printf('<a href="%1$s" target="_blank">%1$s</a>', $url);

/* At the Server - To process the url and check validity */

$querystring = parse_url( $url, PHP_URL_QUERY );

if( !empty( $querystring ) ){

    list( $param, $data )=explode( '=', $querystring );

    /* decrypt data */

    $decrypted=decrypt( $data, $key, $cipher );

    if( $decrypted ){

        /* process initial querystring we created - create an array $out */

        parse_str( $decrypted, $out );

        /* for simplicity, cast as an object to use object notation */

        $obj=(object)$out;

        $endpoint=$obj->endpoint;

        $expires=$obj->expires;

        $ip=$obj->ip;

        /* perform logic tests on the decrypted data and act accordingly */

        if( time() > $expires or $ip!=$_SERVER['REMOTE_ADDR'] ){

            /* too late */

            printf( '<h1>That link has now expired</h1><p>You are no longer premitted to access that resource</p>' );

        } else {

            /* all good */

            printf( '<h1>Welcome</h1><p>%s</p>', $obj->endpoint );

        }

    }

}

Answer 2

我没有复制你代码的所有部分，但这是原则。

将密码和时间分开散列，这样您就可以确保密码正确并独立查看时间。

$secret = "PASSWORD";

$expires = time()+3600; 

$urls= 'http://example.com?md5=" . md5($secret) . "&t=" . md5($expires);

这将独立传递它们，在接收端您将密码与密码匹配，然后循环时间查看它是否有效。

if($_GET['md5'] == $password) $validM = true;

for($i = time()+3600; $i>time(); $i--){

    if(md5($i) == $_GET['t']) $validT = true;

 }

if($validM && $validT){

    echo "within 3600 seconds and correct password";

}

对于世界上大约 95% 的人口来说，这是一种安全的方法，但由于我们通过 GET 传递密码和时间变量，因此弄清楚如何获得非法访问并不难。

如果它需要安全事务，您正在使用它，则不要使用此方法。