[Solved] HMACSHA1Digest gives random results in 32-bit Linux system.

[fedkad]

My testing system is Ubuntu 18.04 (32-bit). However, the same problem occurs in the latest 32-bit Debian 12 (bookworm).

The test program given in https://wiki.freepascal.org/HMAC-SHA1 returns random and incorrect strings.

Example 1 gives always the same incorrect value:

Example 1: dfaf125adbe5cf8c8fbc156a0b6e7ccdceb25db8

While Example 2 gives random values in each program invocation.

I am testing the following program:

Code: Pascal  [Select][+][-]

1. // See some samples in: http://en.wikipedia.org/wiki/Hash-based_message_authentication_code
2. program hsha1;
3.  
4. {$mode objfpc}{$H+}
5.  
6. uses
7.   HMAC;
8.  
9. begin
10.   // for HMAC_SHA1("", "") = 0xfbdb1d1b18aa6c08324b7d64b71fb76370690e1d
11.   WriteLn('Example 1: ', HMACSHA1Print(HMACSHA1Digest('', '')));
12.  
13.   // for HMAC_SHA1("key", "The quick brown fox jumps over the lazy dog") = 0xde7c9b85b8b78aa6bc8a7a36f70a90701c9db4d9
14.   WriteLn('Example 2: ', HMACSHA1('key', 'The quick brown fox jumps over the lazy dog'));
15.   WriteLn('Example 2: ', HMACSHA1Print(HMACSHA1Digest('key', 'The quick brown fox jumps over the lazy dog')));
16. end.

Version of FPC is:

Free Pascal Compiler version 3.2.2 [2021/07/09] for i386 # On Ubuntu 18.04 32-bit
Free Pascal Compiler version 3.2.2+dfsg-20 [2023/03/30] for i386 # On Debian 12 32-bit

No problem on Windows (32-bit and 64-bit) version and Ubuntu 64-bit.

[alpine]

See https://forum.lazarus.freepascal.org/index.php/topic,64467.0.html

[fedkad]

See https://forum.lazarus.freepascal.org/index.php/topic,64467.0.html

Thanks @alpine !

So, as a workaround, I modified the file /usr/share/fpcsrc/3.2.2/packages/hash/src/sha1.pp as explained in https://gitlab.com/freepascal.org/fpc/source/-/commit/ea55c5f7e39447230d15779135130b2aa860cee0 and recompiled using the commands:

$ cd /usr/share/fpcsrc/3.2.2/packages/hash/src/
$ sudo fpc sha1.pp -FU/usr/lib/fpc/3.2.2/units/i386-linux/hash/

And problem is solved.

[Thaddy]

Pity such a trivial one was overlooked for a backport.
Anyway, it is also close to 32 bit i386 code only. Most other platforms are not affected.

WARNING
So users from other platforms should do nothing!

Just in case. E.g. I am mostly compiling for  arm32, aarch64, and x86_64-linux and win64 and none of them are affected.