Account activator link is a use case for HMAC? - php

Question

I'm using PHP and need to design the activator link
$data = $user->email;
$key = $user->token; // bin2hex(openssl_random_pseud_bytes(16));
$hmac = hash_hmac( 'sha256', $data, $key );
So, would send to user the follow url
hostname/account/confirm/7c7b0f24eff74902cb07e900b07a0cafc8fccfa5d2704fb92aaf3b91e9774f98
This way is good idea?
If true, sha256 is best choice for hash_hmac() on this situation? Particularly, i would appreciate one string with length <= 24

Answer 1

TL;DR: You don't need to use hash_hmac() for this use case. You can use the token directly.
If $user->token is generated securely (n.b. you want random_bytes(), not openssl_random_pseudo_bytes(), due to collisions in OpenSSL's random number generator), then it's a secure random value and an attacker has no way of knowing it without hacking the table.
Where you'd want to use HMAC
If you want to authenticate some cleartext data sent to your user's email address, you could use HMAC for this purpose.
For example: On registration, if you need to present users with an option (e.g. GDPR consent), you can create the following two URLs tied to the same token, like so:
$hmacYes = hash_hmac('sha256', 'yes', $user->token);
$hmacNo = hash_hmac('sha256', 'no', $user->token);
Then you can have two links for each option, and send the links like so:
* `hostname/account/confirm/yes${hmacYes}`
* `hostname/account/confirm/no${hmacNo}`
And then you can parse out the HMAC value:
if (!preg_match('/^(yes|no)(.*)$/', $urlParam, $matches) {
throw new SecurityException('bad url');
}
$choice = $matches[1];
$hmac = $matches[2];
$recalc = hash_hmac('sha256', $choice, $user->token);
if (!hash_equals($recalc, $mac)) {
throw new SecurityException('bad url');
}
// Now you know $choice is from a genuine user email
However, if you only need challenge-response authentication, then a secure random token is sufficient.