3

我无法验证 OpenID 签名。这就是我所做的，请告诉我有什么问题：

这些是我在关联时得到的值：

mac_key 3E2FH8mCR/OJ3/T6N3UPqD8iYf0fXyQ0c4io5psTC7s=
assoc_handle AMlYA9WWc0Jk8BnTg9E0cvczK8DYBediGvu5snBaYec9uFlTj3wbY9ezQepX-kFv2foRGQC6

我将客户端重定向到：

https://www.google.com/accounts/o8/ud?openid.ns=http://specs.openid.net/auth/2.0&openid.claimed_id=http://specs.openid.net/auth/2.0/identifier_select&openid.identity=http://specs.openid.net/auth/2.0/identifier_select&openid.return_to=http://www.sdfanq.com/checkauth&openid.realm=http://www.sdfanq.com/&openid.mode=checkid_setup&openid.assoc_handle=AMlYA9WWc0Jk8BnTg9E0cvczK8DYBediGvu5snBaYec9uFlTj3wbY9ezQepX-kFv2foRGQC6

Uppon accepting, the client is redirect back to:

http://www.sdfanq.com/checkauth?openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0&openid.mode=id_res&openid.op_endpoint=https%3A%2F%2Fwww.google.com%2Faccounts%2Fo8%2Fud&openid.response_nonce=2012-05-23T05%3A54%3A30Z0Sv8nDqIrrWYeQ&openid.return_to=http%3A%2F%2Fwww.sdfanq.com%2Fcheckauth&openid.assoc_handle=AMlYA9WWc0Jk8BnTg9E0cvczK8DYBediGvu5snBaYec9uFlTj3wbY9ezQepX-kFv2foRGQC6&openid.signed=op_endpoint%2Cclaimed_id%2Cidentity%2Creturn_to%2Cresponse_nonce%2Cassoc_handle&openid.sig=HtlEGDEmee1UsH9fZg%2BQXt3JCyk11Lb7RMTNEcxbCKo%3D&openid.identity=https%3A%2F%2Fwww.google.com%2Faccounts%2Fo8%2Fid%3Fid%3DAItOawlUNTJm8YX2SyJ2QXsg9eBe3g0LNnKKXwY&openid.claimed_id=https%3A%2F%2Fwww.google.com%2Faccounts%2Fo8%2Fid%3Fid%3DAItOawlUNTJm8YX2SyJ2QXsg9eBe3g0LNnKKXwY

To verify the signature I concatenate the keys like this:

op_endpoint:https://www.google.com/accounts/o8/ud\nclaimed_id:https://www.google.com/accounts/o8/id?id=AItOawlUNTJm8YX2SyJ2QXsg9eBe3g0LNnKKXwY\nidentity:https://www.google.com/accounts/o8/id?id=AItOawlUNTJm8YX2SyJ2QXsg9eBe3g0LNnKKXwY\nreturn_to:http://www.sdfanq.com/checkauth\nresponse_nonce:2012-05-23T05:54:30Z0Sv8nDqIrrWYeQ\nassoc_handle:AMlYA9WWc0Jk8BnTg9E0cvczK8DYBediGvu5snBaYec9uFlTj3wbY9ezQepX-kFv2foRGQC6\n

Now when I base64.encode(hmac256("3E2FH8mCR/OJ3/T6N3UPqD8iYf0fXyQ0c4io5psTC7s=", S)), where 'S' is the concatenated string, I get a wrong value.

4

1 回答 1

3

您忘记对密钥进行 base64 解码。作为一般经验法则：如果某些东西看起来像 base64，那么至少尝试对其进行解码并不是一个坏主意。

尝试这个：

<?php
$string="op_endpoint:https://www.google.com/accounts/o8/ud
claimed_id:https://www.google.com/accounts/o8/id?id=AItOawlUNTJm8YX2SyJ2QXsg9eBe3g0LNnKKXwY
identity:https://www.google.com/accounts/o8/id?id=AItOawlUNTJm8YX2SyJ2QXsg9eBe3g0LNnKKXwY
return_to:http://www.sdfanq.com/checkauth
response_nonce:2012-05-23T05:54:30Z0Sv8nDqIrrWYeQ
assoc_handle:AMlYA9WWc0Jk8BnTg9E0cvczK8DYBediGvu5snBaYec9uFlTj3wbY9ezQepX-kFv2foRGQC6
"; //first we take the string to be signed

$key=base64_decode("3E2FH8mCR/OJ3/T6N3UPqD8iYf0fXyQ0c4io5psTC7s="); //the key needs to be Base64 decoded.

$orisig="HtlEGDEmee1UsH9fZg+QXt3JCyk11Lb7RMTNEcxbCKo="; //take the original signature to check it later

$truesig=base64_encode(hash_hmac("sha256",$string,$key,true)); //calculate the signature you get

echo $truesig."<br>".$orisig."<br>"; //output both
var_dump($orisig==$truesig) //and show they are the same.
?>

我希望解决这些非常古老的问题不是问题。

于 2018-03-22T11:12:53.700 回答