PHP How to calculate the length of a session identifier before starting a session

Question

How to calculate the length of a PHP session identifier based on the values ​​of php.ini session.hash_function and session.hash_bits_per_character and before starting the session.

I want to create and assign my own session identifier, for example session_id($customSessionId); before the start of the session.

In my local machine, the value of session.hash_function is 0 (possible values ​​are "0" for MD5 and "1" for SHA-1), and the value of session.hash_bits_per_character is 5 (possible values: "4" [0-9, af], '5' [0-9, av] and '6' [0-9, az, AZ, "-", ","]), and the total length of the session identifier is 26.

What will be the length of the session identifier when session.hash_function and session.hash_bits_per_character have a different set of values ​​that can be calculated before the session starts?

I want to calculate the session identifiers of different lengths on different servers (local, intermediate or production) and analyze the default session settings.

Starting a session and calculating a session ID is much easier. But I want to code the code like this:

 // $length = {code to get length from hash_function and hash_bits_per_character} // this is my custom function to generate new session id having length $length $myCustomSessionId = generateCustomSessionId($length); // assign my custom session id session_id($myCustomSessionId); //and finally start the session :) session_start(); 

Answer 1

Here are all session hash session algorithms for 5.3. Use my code below if you want to try it on your own server.

 algo bits length md2 4 32 md2 5 26 md2 6 22 md4 4 32 md4 5 26 md4 6 22 md5 4 32 md5 5 26 md5 6 22 sha1 4 40 sha1 5 32 sha1 6 27 sha224 4 56 sha224 5 45 sha224 6 38 sha256 4 64 sha256 5 52 sha256 6 43 sha384 4 96 sha384 5 77 sha384 6 64 sha512 4 128 sha512 5 103 sha512 6 86 ripemd128 4 32 ripemd128 5 26 ripemd128 6 22 ripemd160 4 40 ripemd160 5 32 ripemd160 6 27 ripemd256 4 64 ripemd256 5 52 ripemd256 6 43 ripemd320 4 80 ripemd320 5 64 ripemd320 6 54 whirlpool 4 128 whirlpool 5 103 whirlpool 6 86 tiger128,3 4 32 tiger128,3 5 26 tiger128,3 6 22 tiger160,3 4 40 tiger160,3 5 32 tiger160,3 6 27 tiger192,3 4 48 tiger192,3 5 39 tiger192,3 6 32 tiger128,4 4 32 tiger128,4 5 26 tiger128,4 6 22 tiger160,4 4 40 tiger160,4 5 32 tiger160,4 6 27 tiger192,4 4 48 tiger192,4 5 39 tiger192,4 6 32 snefru 4 64 snefru 5 52 snefru 6 43 snefru256 4 64 snefru256 5 52 snefru256 6 43 gost 4 64 gost 5 52 gost 6 43 adler32 4 8 adler32 5 7 adler32 6 6 crc32 4 8 crc32 5 7 crc32 6 6 crc32b 4 8 crc32b 5 7 crc32b 6 6 salsa10 4 128 salsa10 5 103 salsa10 6 86 salsa20 4 128 salsa20 5 103 salsa20 6 86 haval128,3 4 32 haval128,3 5 26 haval128,3 6 22 haval160,3 4 40 haval160,3 5 32 haval160,3 6 27 haval192,3 4 48 haval192,3 5 39 haval192,3 6 32 haval224,3 4 56 haval224,3 5 45 haval224,3 6 38 haval256,3 4 64 haval256,3 5 52 haval256,3 6 43 haval128,4 4 32 haval128,4 5 26 haval128,4 6 22 haval160,4 4 40 haval160,4 5 32 haval160,4 6 27 haval192,4 4 48 haval192,4 5 39 haval192,4 6 32 haval224,4 4 56 haval224,4 5 45 haval224,4 6 38 haval256,4 4 64 haval256,4 5 52 haval256,4 6 43 haval128,5 4 32 haval128,5 5 26 haval128,5 6 22 haval160,5 4 40 haval160,5 5 32 haval160,5 6 27 haval192,5 4 48 haval192,5 5 39 haval192,5 6 32 haval224,5 4 56 haval224,5 5 45 haval224,5 6 38 haval256,5 4 64 haval256,5 5 52 haval256,5 6 43 

Here is the code I used to create them:

 session_start(); $algos = hash_algos(); foreach ($algos as $key => $algo) { ini_set('session.hash_function', $algo); for ($i = 4; $i <= 6; $i++) { ini_set('session.hash_bits_per_character', $i); session_regenerate_id(); echo $algo . ' - ' . $i . ' - ' . strlen(session_id()) . '<br>'; } } 

Answer 2

I know that I'm half a year late. However, here is the answer.

Each of the hashing algorithms returns a string with a fixed length. It is easy to understand that length just calculates the hash:

 $t = hash('md5', '', True); print strlen($t)*8; // 8 Bits per char 

The ini session.hash_bits_per_character parameter specifies how the hashed string (which is a binary string) should be converted to make it printable and safe to store. It indicates how many bits of the original hash will be converted to one character in the output. The value 4 is used to get the hexadecimal output, since each hexadecimal digit represents 4 bits. The value 6 is Base 64 encoding. You can use the information on session.hash_function and session.hash_bits_per_character to calculate the size of the resulting session identifier that computes the hash, and then calculate the final length that it will have:

 $hash_function = ini_get("session.hash_function"); // Special case: 0=md5 and 1=sha1, anything else should be the // name of the hashing algorithm if($hash_function==0) { $hash_function="md5"; } elseif($hash_function==1) { $hash_function="sha1"; }; $hash_bits = ini_get("session.hash_bits_per_character"); $t = hash($hash_function, "", True); print "Algorithm: $hash_function\n"; print "Hash Length (chars): " . strlen($t) . "\n"; print "Bits Per Char: $hash_bits\n"; print "Final Length (chars): " . ceil(strlen($t)*8/$hash_bits) . "\n"; 

 Algorithm: md5
 Hash Length (chars): 16
 Bits Per Char: 5
 Final Length (chars): 26