HMAC SHA-1 Challenge

Forums

My Profile

Inbox

Address Book

My Subscription

My Forums

HMAC SHA-1 Challenge

Logged in as: Guest

arrSession:exec spGetSession 2,2,60194

	Active Users: There are 0 members and 0 guests.
	Users viewing this topic: none

Printable Version

All Forums >> [Scripting] >> WSH & Client Side VBScript >> HMAC SHA-1 Challenge
Do you like VisualBasicScript.com? Link to us and help spread the word about our forum. Thanks!

Page: [1]

Message

<< Older Topic Newer Topic >>

HMAC SHA-1 Challenge - 5/14/2008 4:12:38 AM

atwork8

Posts: 6
Score: 0
Joined: 5/2/2008
Status: offline

Hi there,

I'm using the following code to hash a string using sha-1:

http://p2p.wrox.com/archive/proasp_howto/2002-02/27.asp

Now what I'm trying to do is write a function to return an HMAC (HMAC-SHA-1). I've used the implementations listed on the following links:

http://en.wikipedia.org/wiki/HMAC#Implementation
http://tools.ietf.org/html/rfc2104

And my function so far looks like this:

<%
function hmac(key,text)
   dim h 'hash function md5, sha1 etc
   dim k 'secret key
   dim b 'Blocksize "in bytes" of the hash function (sha1 blocksize = 512 bits : 8bits in byte : 512/8 = 64 bytes)
   dim l 'Byte length of the generated hash (sha1 outputs 160 bits : 8bits in byte : 160/8 = 20 bytes)
   dim arrSize 'array size for our string byte array. will be "b" above (b-1) as arrays are 0 based
           
   h = "sha1"
   k = key '64 bytes to keep it simple
   b = 64
   l = 20
   arrSize = b-1
   
   dim arrIpad()
   redim arrIpad(arrSize)
   
   dim arrOpad()
   redim arrOpad(arrSize)
   
   dim strIpad
   dim strOpad
   dim i
   
   'TODO: add code to check key size. made key 64 bytes to keep things simple
           
   for i=0 to arrSize
       arrIpad(i) = &h36
       arrOpad(i) = &h5c
   next
   
   for i=0 to arrSize
       arrIpad(i) = arrIpad(i) Xor Asc(CStr(Mid(k,i+1,1)))
       arrOpad(i) = arrOpad(i) Xor Asc(CStr(Mid(k,i+1,1)))
       strIpad = strIpad & arrIpad(i)
       strOpad = strOpad & arrOpad(i)
   next
           
   hmac = sha1(strOpad & sha1(strIpad & text))
end function

response.write hmac(")!%rw{LH:[9b|!2A,an_n}]}aLnzTzbHdOIC%Y/?4bC&J[h-+hfM`Lj_>B[/7i#I","hello world")
%>

The expected output is:   1da1b8f5901f02b0d95532acbf9c0db9f7b427ee
Actual output:   85c1891c3a7ba16d0582126ee4849f250fc95c45

I've been at this for ages, can anybody point me in the right direction to get this to work? or is there a hmac function already written in vbscript? I checked all over the net but couldn't find a vbscript implementation

Any help would be really appreciated, thanks

Post #: 1

RE: HMAC SHA-1 Challenge - 5/14/2008 5:00:19 AM

yfki

Posts: 78
Score: 0
Joined: 12/12/2007
Status: offline

Is this a make-shift encryption style function? or do you really need the hash?

(in reply to atwork8)

Post #: 2

RE: HMAC SHA-1 Challenge - 5/14/2008 6:42:50 AM

atwork8

Posts: 6
Score: 0
Joined: 5/2/2008
Status: offline

Hi yfki,

I'm not sure what you mean by "make-shift", keyed-Hash Message Authentication Code (HMAC), is used to ensure data integrity when a message is sent to part of the system. I don't usually do much in vbscript so I'm having trouble implementing the HMAC side of things. The hash is taken care of by the sha-1 code I have linked to.

Thanks for any help :)

(in reply to yfki)

Post #: 3

RE: HMAC SHA-1 Challenge - 5/14/2008 7:30:00 AM

mcnd

Posts: 23
Score: 0
Joined: 4/27/2008
Status: offline

There's an interpretation problem in your implementation

in the line

hmac = sha1(strOpad & sha1(strIpad & text))

when you calculate sha1( strIpad & text ), your function sha1 returns a 40 character string, BUT the RFC says you must use the 20 bytes (160 bit) value of the sha1, not the hex representation of it.

(in reply to atwork8)

Post #: 4

RE: HMAC SHA-1 Challenge - 5/14/2008 9:43:33 AM

atwork8

Posts: 6
Score: 0
Joined: 5/2/2008
Status: offline

Hi mcnd,

Nice one! Looks as if i might be getting somewhere now with that tip! I take it I want the binary version then?

I'm sure you know what my next question is, do you know how i can return the 160 bit sha?

Thanks again for the help

(in reply to mcnd)

Post #: 5

RE: HMAC SHA-1 Challenge - 5/14/2008 5:07:14 PM

mcnd

Posts: 23
Score: 0
Joined: 4/27/2008
Status: offline

I haven't seen your implementation of the sha1 hash, but i suppose your are using a byte[20] array or a long[5] array to hold the 160 bits of sha1, and in the last step, encoding this information to hex so you get 40 chars.

So, don't encode to hex. Just return a byte array and use that array into your hmac function.

(in reply to atwork8)

Post #: 6

If you found our site useful please link to us <a href="http://www.visualbasicscript.com">VisualBasicScript.com</a>.

All Forums >> [Scripting] >> WSH & Client Side VBScript >> HMAC SHA-1 Challenge

Page: [1]

Jump to:

New Messages	No New Messages
Hot Topic w/ New Messages	Hot Topic w/o New Messages
Locked w/ New Messages	Locked w/o New Messages

Post New Thread

Reply to Message

Post New Poll

Submit Vote

Delete My Own Post

Delete My Own Thread

Rate Posts