hmac

How to generate an HMAC in Java equivalent to a Python example?

by

HmacSHA1 seems to be the algorithm name you need: SecretKeySpec keySpec = new SecretKeySpec( “qnscAdgRlkIhAUPY44oiexBKtQbGY0orf7OV1I50”.getBytes(), “HmacSHA1”); Mac mac = Mac.getInstance(“HmacSHA1”); mac.init(keySpec); byte[] result = mac.doFinal(“foo”.getBytes()); BASE64Encoder encoder = new BASE64Encoder(); System.out.println(encoder.encode(result)); produces: +3h2gpjf4xcynjCGU5lbdMBwGOc= Note that I’ve used sun.misc.BASE64Encoder for a quick implementation here, but you should probably use something that doesn’t depend on the Sun … Read more

How to generate HMAC-SHA1 in C#?

by

an extension to Vimvq1987’s answer: return hashValue.ToString(); doesn’t produce the output you want/need. You have to convert the bytes in the array hashValue to their hex-string representation. Can be as simple as return BitConverter.toString(hashValue); (prints upper-case letters A-F) or if you like it a bit more complex: using System; using System.Collections.Generic; using System.Linq; using System.Text; … Read more

Implementation HMAC-SHA1 in python

by

Pseudocodish: def sign_request(): from hashlib import sha1 import hmac # key = b”CONSUMER_SECRET&” #If you dont have a token yet key = b”CONSUMER_SECRET&TOKEN_SECRET” # The Base String as specified here: raw = b”BASE_STRING” # as specified by OAuth hashed = hmac.new(key, raw, sha1) # The signature return hashed.digest().encode(“base64”).rstrip(‘\n’) Signature errors usually reside in the base-string, … Read more

HMAC-SHA1: How to do it properly in Java?

by

On your PHP side, use single-quotes around the key so that the $ character is not treated as a variable reference. i.e., hash_hmac(“sha1”, “helloworld”, ‘PRIE7$oG2uS-Yf17kEnUEpi5hvW/#AFo’) Otherwise, the key you really get is PRIE7-Yf17kEnUEpi5hvW/#AFo (assuming the variable $oG2uS is not defined).

How to send password securely via HTTP using Javascript in absence of HTTPS?

by

There is no way to send a password securely that the user can verify without SSL. Sure, you can write some JavaScript that will make a password secure for over-the-wire transmission through hashing or public-key-encryption. But how can the user be sure that the JavaScript itself has not been tampered with by a man-in-the-middle before … Read more

Objective-C sample code for HMAC-SHA1 [closed]

by

Here’s how you generate an HMAC using SHA-256: NSString *key; NSString *data; const char *cKey = [key cStringUsingEncoding:NSASCIIStringEncoding]; const char *cData = [data cStringUsingEncoding:NSASCIIStringEncoding]; unsigned char cHMAC[CC_SHA256_DIGEST_LENGTH]; CCHmac(kCCHmacAlgSHA256, cKey, strlen(cKey), cData, strlen(cData), cHMAC); NSData *HMAC = [[NSData alloc] initWithBytes:cHMAC length:sizeof(cHMAC)]; NSString *hash = [HMAC base64Encoding]; I’m not aware of an HOTP library, but the algorithm … Read more

What’s the difference between Message Digest, Message Authentication Code, and HMAC?

by

A message digest algorithm takes a single input — a message — and produces a “message digest” (aka hash) which allows you to verify the integrity of the message: Any change to the message will (ideally) result in a different hash being generated. An attacker that can replace the message and digest is fully capable … Read more

HMAC-SHA256 Algorithm for signature calculation

by

Here is my solution: public static String encode(String key, String data) throws Exception { Mac sha256_HMAC = Mac.getInstance(“HmacSHA256”); SecretKeySpec secret_key = new SecretKeySpec(key.getBytes(“UTF-8”), “HmacSHA256”); sha256_HMAC.init(secret_key); return Hex.encodeHexString(sha256_HMAC.doFinal(data.getBytes(“UTF-8”))); } public static void main(String [] args) throws Exception { System.out.println(encode(“key”, “The quick brown fox jumps over the lazy dog”)); } Or you can return the hash encoded … Read more