HMAC-SHA512 hash missing from Authorize.Net AIM response

I was caught off guard by Authorize.Net's recent retirement of the md5 hash to authenticate their responses to AIM transactions. I'm trying to fix some legacy code to keep our legacy site limping along until we can get the rebuilt site out -- IT WILL NOT RUN the latest Authorize.Net PHP SDK so please do not suggest that in response to this question.

In trying to fix this legacy code, I cannot get the test transactions (or even some test transactions run using live/production credentials) to supply the HMAC-SHA512 hash promised in the Aim Guide in the section titled "Authenticating the Response."

Here's a sample raw response from an AIM transaction:

"1"|"1"|"1"|"This transaction has been approved."|"52R4QE"|"Y"|"40034138508"|"2019-07-0269072"|"Purchase Description Blah Blah Blah"|"99.95"|"CC"|"auth_capture"|"3"|"Joe"|"Test"|"n/a"|"123 Main St."|"Los Angeles"|"CA"|"90026"|"US"|""|""|"joe.test@example.com"|""|""|""|""|""|""|""|""|""|""|""|""|""|""|"P"|"2"|""|""|""|""|""|""|""|""|""|""|"XXXX1111"|"Visa"|""|""|""|""|""|""|""|""|""|""|""|""|""|""|""|""|""

According to the AIM Guide:

"The last field in the response contains the HMAC-SHA512 hash that Authorize.Net generated for the transaction, which can be used to authenticate the response. To use it, construct an HMAC-SHA512 hash..."

This does not appear to be the case at all. Is this HMAC only present for certain types of transacations? Is it not provided by the sandbox gateway? What's the deal? Where is the HMAC-SHA512 hash?

Here is a PHP script which illustrates my problem:

<?php
$now = time();
// AUTOMATICALLY GENERATE AN INVOICE NUMBER
$invoice_number = date('Y', $now) . "-" . date('m', $now) . "-" . date('d', $now) . rand(0,100000);

// Authorize.net credentials
$api_login_id = "<YOUR API-LOGIN-ID-HERE>";
$transaction_key = "<YOUR TRANSACTION KEY HERE>";

$authnet_values = array(
//  "x_test_request"        => "TRUE",
    "x_login"           => $api_login_id,
    "x_version"         => "3.1",
    "x_delim_char"          => "|",
    "x_encap_char"          => "\"",
    "x_delim_data"          => "TRUE",
    "x_url"             => "FALSE",
    "x_type"            => "AUTH_CAPTURE",
    "x_method"          => "CC",
    "x_tran_key"            => $transaction_key,
    "x_relay_response"      => "FALSE",
    "x_card_num"            => "4111111111111111",
    "x_exp_date"            => "01-2020",
    "x_description"         => "TEST TRANSACTION " . uniqid(),
    "x_amount"          => 12.34,
    "x_currency_code"       => "USD",

    "x_cust_id"         => 1234,
    "x_first_name"          => "Joe",
    "x_last_name"           => "Test",
    "x_company"         => "",
    "x_address"         => "123 Main St.",
    "x_city"            => "Springfield",
    "x_state"           => "MO",
    "x_zip"             => "12345",
    "x_email"           => "Joe.Text@example.com",
    "x_invoice_num"         => uniqid(),
);

$fields = "";
foreach( $authnet_values as $key => $value ) $fields .= "$key=" . urlencode( $value ) . "&";


// ========== !!! DO THE TRANSACTION !!! ==========
// URL of gateway for cURL to post to
$url = "https://test.authorize.net/gateway/transact.dll";
//$url = "https://secure.authorize.net/gateway/transact.dll";
$ch = curl_init($url)
    or die("Couldn't establish connection to payment gateway, code 1");

// set to 0 to eliminate header info from response
curl_setopt($ch, CURLOPT_HEADER, 0)
    or die("Couldn't establish connection to payment gateway, code 2");

// Returns response data instead of printing it out directly
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1)
    or die("Couldn't establish connection to payment gateway, code 3");

// use HTTP POST to send form data
curl_setopt($ch, CURLOPT_POST, TRUE)
    or die("Couldn't establish connection to payment gateway, code 4a");

// supply POST data
curl_setopt($ch, CURLOPT_POSTFIELDS, rtrim( $fields, "& " ))
    or die("Couldn't establish connection to payment gateway, code 4b");

// Optionally use an old cert bundle or we face ssl authentication problems
//curl_setopt($ch, CURLOPT_CAINFO, '/var/www/ca-bundle/old-ca-bundle.pem')
//  or die("Could not  establish connection to payment gateway, code 5");

$resp = curl_exec($ch); //execute post and get results
echo "=== RAW ===\n";
print_r($resp);
echo "=== END RAW ===\n";

$curl_info = curl_getinfo($ch);

$curl_info["curl_error"] = curl_error($ch);
$curl_info["curl_errno"] = curl_errno($ch);
echo "=== CURL_INFO ===\n";
print_r($curl_info);
echo "=== END CURL_INFO ===\n";

curl_close ($ch);

$parsed = str_getcsv($resp, '|');
echo "=== PARSED ===\n";
print_r($parsed);
echo "=== END PARSED ===\n";

Solution

Your code works for me:

Make sure you have generated a signature key. Without one a hash will not be calculated for you as the signature key is required to generate it).