Java Security

Hello Java Developers,

Quite simply, I am generating an MD5 fingerprint from Java and wanting to verify it in PHP on a remote web site. No matter what I've tried and despite all my trouble-shooting, the results always come out differently.

I understand that PHP's md5 function returns the result as a hex string. I've written my own Java toHexString function, but the result still comes out different (slightly different in fact). I will paste both my Java code and PHP code, let me know if you see anything wrong:

Java Code:

	MessageDigest	md5 = MessageDigest.getInstance("MD5");
	Date		dt = Calendar.getInstance().getTime();
	Random		r = new Random (dt.getTime ());
	int		nRandom;
	String		s;
			
	nRandom = sr.nextInt();
	s = (nRandom + ":" + nCode + ":" + (nRandom ^ 426473384));
	
	// I've also tried "US-ASCII" here
	md5.update (s.getBytes ("UTF-8")); 

	// Returns URL fingerprint and ingredients to be sent to PHP script
	return "fp=" + toHexString (md5.digest()) + "&r=" + nRandom;

The toHexString function:

	private String toHexString (byte [] v)
	{
		StringBuffer	sb = new StringBuffer ();
		byte		n1, n2;
		
		for (int c = 0; c < v.length; c++)
		{
			n1 = (byte)((v[c] < 0 ? -v[c] + 127 : v[c]) / 0x10);
			n2 = (byte)((v[c] < 0 ? -v[c] + 127 : v[c]) % 0x10);
			
			sb.append (n1 >= 0xA ? (char)(n1 - 0xA + 'a') : (char)(n1 + '0'));
			sb.append (n2 >= 0xA ? (char)(n2 - 0xA + 'a') : (char)(n2 + '0'));
		}
		
		return sb.toString();
	}

PHP Code:

$s = $_GET['r'] . ":" . $_GET['code'] . ":" . ((int)$_GET['r'] ^ 426473384);
echo $s . "<BR>";
echo $_GET['fp'] . " == " . md5($s);

The results always differ, and I have verified that the XOR mathematical expression is consistent between Java and PHP. Thanks for your time, any help would be greatly appreciated.

Jonathan Neufeld
Software Engineer
http://www.extollit.com