public function processOutcome($data)
    {
        $verifier_regexp = '#^v=((?:[A-Za-z0-9/+]{4})*(?:[A-Za-z0-9]{3}=|[A-Xa-z0-9]{2}==)?)$#';
        $matches = [];
        if (!isset($this->saltedPassword, $this->authMessage)
            || !preg_match($verifier_regexp, $data, $matches))
        {
            // This cannot be an outcome, you never sent the challenge's response.
            return false;
        }

        $verifier = $matches[1];
        $proposed_serverSignature = base64_decode($verifier);
        $serverKey = call_user_func($this->hmac, $this->saltedPassword, "Server Key", true);
        $serverSignature = call_user_func($this->hmac, $serverKey, $this->authMessage, TRUE);
        return ($proposed_serverSignature === $serverSignature);
    }
public function processOutcome($data)
    {
        $verifier_regexp = '#^v=((?:[A-Za-z0-9/+]{4})*(?:[A-Za-z0-9]{3}=|[A-Xa-z0-9]{2}==)?)$#';
        $matches = [];
        if (!isset($this->saltedPassword, $this->authMessage)
            || !preg_match($verifier_regexp, $data, $matches))
        {
            // This cannot be an outcome, you never sent the challenge's response.
            return false;
        }

        $verifier = $matches[1];
        $proposed_serverSignature = base64_decode($verifier);
        $serverKey = call_user_func($this->hmac, $this->saltedPassword, "Server Key", true);
        $serverSignature = call_user_func($this->hmac, $serverKey, $this->authMessage, TRUE);
        return ($proposed_serverSignature === $serverSignature);
    }
public function processOutcome ( $ data ) { $ verifier_regexp = '#^v=((?:[A-Za-z0-9/+]{4})*(?:[A-Za-z0-9]{3}=|[A-Xa-z0-9]{2}==)?)$#' ; $ matches = [ ] ; if ( ! isset ( $ this -> saltedPassword , $ this -> authMessage ) || ! preg_match ( $ verifier_regexp , $ data , $ matches ) ) { // This cannot be an outcome, you never sent the challenge's response. return false ; } $ verifier = $ matches [ 1 ] ; $ proposed_serverSignature = base64_decode ( $ verifier ) ; $ serverKey = call_user_func ( $ this -> hmac , $ this -> saltedPassword , "Server Key" , true ) ; $ serverSignature = call_user_func ( $ this -> hmac , $ serverKey , $ this -> authMessage , TRUE ) ; return ( $ proposed_serverSignature === $ serverSignature ) ; }
SCRAM has also a server verification step. On a successful outcome, it will send additional data which must
absolutely be checked against this function. If this fails, the entity which we are communicating with is probably
not the server as it has not access to your ServerKey.

@param string $data The additional data sent along a successful outcome.
@return bool Whether the server has been authenticated.
If false, the client must close the connection and consider to be under a MITM attack.
@access public
SCRAM has also a server verification step . On a successful outcome it will send additional data which must absolutely be checked against this function . If this fails the entity which we are communicating with is probably not the server as it has not access to your ServerKey .