HMAC_SHA1在PHP和Lua上有所不同

Question

I'm trying to generate a HMAC_SHA1 in php, and validate it in openresty lua

PHP Code:

$hmac_sha1 = hash_hmac('sha1', 'test', 'gabri', true);
echo base64_encode($hmac_sha1);

Which produces:

/ReAJgDe67/lF3BNbaGSCx70J/c=

And the same code in lua:

local hmac_sha1 = ngx.hmac_sha1("test", "gabri")
ngx.log(ngx.NOTICE,  ngx.encode_base64(hmac_sha1) );

produces:

Yczcenrc2EAOpfm9UEWwME9XLRI=

Why are they different?

In PHP, I've included the 4th parameter on hash_hmac, which return the data as raw binary

As per: https://github.com/openresty/lua-nginx-module#ngxhmac_sha1

The raw binary form of the HMAC-SHA1 digest will be generated, use ngx.encode_base64, for example, to encode the result to a textual representation if desired.

Answer 1

According docs

string hash_hmac(string $algo, string $data, string $key [, bool $raw_output = false]) digest = ngx.hmac_sha1(secret_key, str)

So in hash_hmac('sha1', 'test', 'gabri', true); test is data and gabri is key. But in ngx.hmac_sha1("test", "gabri") gabri is data and test is key