PHP HMAC - Will this implementation of a hmac validator be sufficient? - php

Question

The following function is part of a Request class. The class basically just holds the information parsed from the headers and body, and I want to implement a secure HMAC validation scheme. I have not done this before, but I have read A LOT on the subject, both here on SO and other places. I chose the sha256 algo as a middle way between performance and security.
The class holds all the variables except the API_KEY which is a defined constant that changes for each version and the shared secret which I store in a DB after an initial three-way exchange with public-key encryption securing the shared secret during device-registration. validNonce() just looks up the nonce in the DB to see if it is valid.
My questions boils down to: Am I on the right track? Am I missing something bleeding obvious?
public function isValidRequest($secret)
{
if(!validNonce($this->nonce))
{
return false;
}
$data = API_KEY . $this->device_key . $this->user_key .
$this->cnonce . $this->nonce . $this->body;
$hmac_hash = hash_hmac("sha256",$data,$secret);
return $this->hash === $hmac_hash;
}

Answer 1

Am I on the right track? Am I missing something bleeding obvious?
Timing attacks! Okay, so it's not really obvious, but that's the missing piece of the puzzle here.
The general solution (in diff format) is:
- return $this->hash === $hmac_hash;
+ return hash_equals($this->hash, $hmac_hash);
Furthermore, how you feed your data into HMAC needs to be carefully considered when working with multipart messages. Otherwise, even though you're using HMAC securely, you'll introduce the risk of creating two identical strings from different combinations of its constituent parts, which might be security-affecting.
$data = API_KEY . $this->device_key . $this->user_key .
$this->cnonce . $this->nonce . $this->body;
This was a concern of mine when I designed PASETO, so I defined a scheme I call PAE (pre-authentication encoding) that makes these messages distinct and unambiguous. You can find an implementation here (reproduced below):
<?php
class Util
{
// ~8<~8<~8<~8<~8<~ SNIP SNIP ~8<~8<~8<~8<~8<~
/**
* Format the Additional Associated Data.
*
* Prefix with the length (64-bit unsigned little-endian integer)
* followed by each message. This provides a more explicit domain
* separation between each piece of the message.
*
* Each length is masked with PHP_INT_MAX using bitwise AND (&) to
* clear out the MSB of the total string length.
*
* #param string ...$pieces
* #return string
*/
public static function preAuthEncode(string ...$pieces): string
{
$accumulator = \ParagonIE_Sodium_Core_Util::store64_le(\count($pieces) & PHP_INT_MAX);
foreach ($pieces as $piece) {
$len = Binary::safeStrlen($piece);
$accumulator .= \ParagonIE_Sodium_Core_Util::store64_le($len & PHP_INT_MAX);
$accumulator .= $piece;
}
return $accumulator;
}
// ~8<~8<~8<~8<~8<~ SNIP SNIP ~8<~8<~8<~8<~8<~
}
And a compatible JavaScript implementation:
function LE64(n) {
var str = '';
for (var i = 0; i < 8; ++i) {
if (i === 7) {
// Clear the MSB for interoperability
n &= 127;
}
str += String.fromCharCode(n & 255);
n = n >>> 8;
}
return str;
}
function PAE(pieces) {
if (!Array.isArray(pieces)) {
throw TypeError('Expected an array.');
}
var count = pieces.length;
var output = LE64(count);
for (var i = 0; i < count; i++) {
output += LE64(pieces[i].length);
output += pieces[i];
}
return output;
}
What this means is that you'd want your final result to use something like PAE to encode all of the pieces into the $data function when creating AND verifying your HMAC tags. Don't forget to use hash_equals() to compare the two strings.