problem with SHA-256

[R Amlani]

Hi All,

Before few days I got a requirement from a client to form one url to call one webservice. One of the params was to be processed by sha256 and base 64.

--> the prior requirement was to give stringToBeHashed and key as input params. I set this two params for the input of sha256 method. It was working fine, I also checked my code with online converters also.

--> Now the problem is that he wants the output data in raw binary output format about which I don't know. As per his instruction and my info this is the only one line code in PHP as following :

digest_temp = OpenSSL::Digest::Digest.new('sha256')
hmach = OpenSSL::HMAC.digest(digest_temp, @apiprivkey, string_to_sign)

Let me also give you example of output he wants.
stringToBeHashed --> ABCDEF
key --> 123
output --> t����Y�m@�����k/gba۫�6���M (this is what I want to get)

And what I'm and all tools are getting is --> 56c2201a9c7a4eaeaf3664724d42b678b10d03ce73e5e72a526d45f1daa53d97


the code which currently I use is,

public String hmacSHA256(String message, byte[] key) {

	        // Start by getting an object to generate SHA-256 hashes with.
	        MessageDigest sha256 = null;
	        try {
	            sha256 = MessageDigest.getInstance("SHA-256");
	        } catch (NoSuchAlgorithmException e) {
	            throw new java.lang.AssertionError(
	                    this.getClass().getName()
	                    + ".hmacSHA256(): SHA-256 algorithm not found!");
	        }

	        // Hash the key if necessary to make it fit in a block (see RFC 2104).
	        if (key.length > 64) {
	            sha256.update(key);
	            key = sha256.digest();
	            sha256.reset();
	        }

	        // Pad the key bytes to a block (see RFC 2104).
	        byte block[] = new byte[64];
	        for (int i = 0; i < key.length; ++i) block[i] = key[i];
	        for (int i = key.length; i < block.length; ++i) block[i] = 0;

	        // Calculate the inner hash, defined in RFC 2104 as
	        // SHA-256(KEY ^ IPAD + MESSAGE)), where IPAD is 64 bytes of 0x36.
	        for (int i = 0; i < 64; ++i) block[i] ^= 0x36;
	        sha256.update(block);
	        try {
	            sha256.update(message.getBytes("UTF-8"));
	        } catch (UnsupportedEncodingException e) {
	            throw new java.lang.AssertionError(
	                    "ITunesU.hmacSH256(): UTF-8 encoding not supported!");
	        }
	        byte[] hash = sha256.digest();
	        sha256.reset();

	        // Calculate the outer hash, defined in RFC 2104 as
	        // SHA-256(KEY ^ OPAD + INNER_HASH), where OPAD is 64 bytes of 0x5c.
	        for (int i = 0; i < 64; ++i) block[i] ^= (0x36 ^ 0x5c);
	        sha256.update(block);
	        sha256.update(hash);
	        hash = sha256.digest();

	        // The outer hash is the message signature...
	        // convert its bytes to hexadecimals.
	        char[] hexadecimals = new char[hash.length * 2];
	        for (int i = 0; i < hash.length; ++i) {
	            for (int j = 0; j < 2; ++j) {
	                int value = (hash[i] >> (4 - 4 * j)) & 0xf;
	                char base = (value < 10) ? ('0') : ('a' - 10);
	                hexadecimals[i * 2 + j] = (char)(base + value);
	            }
	        }

	        // Return a hexadecimal string representation of the message signature.
	        System.out.println("Result in SHA-256 with Key : "+new String(hexadecimals)+" Length : "+new String(hexadecimals).length());
	        return new String(hexadecimals);

	    }
	

will any one can help me out to solve this ?

[James Sabre]

There is no need to implement all that Java! The JCE has the algorithm build in.

            SecretKey signingKey = new SecretKeySpec(keyBytes, "HMACSHA256");
                Mac mac = Mac.getInstance( "HMACSHA256");
                mac.init(signingKey);
                byte[] digest = mac.doFinal(message.getBytes("UTF-8"));
      

The result is not Base64 encoded so it is binary.


Note - printing out the binary as you have done will not display anything sensible. You should just compare the content of the desired result with result you obtain.

[R Amlani]

Hi James,

Thanks for replying. But I've already tried out this solution and I also compared the values.

--> Now, I just got more info that the output which I got, need to be given as an input of the base 64 and I must get the output = "dL7Y8OuzWaxtQJj33gKqEO1rL2diYdurxAM2o//2TRI="
(for the input which I've described in que.)

and currently I am getting "W0JAOTExZjcx".

[R Amlani]

I also tried to convert it into string using UTF-8 and then gave it to base64 but still not getting proper/desired output.

Please help me out.

[James Sabre]

R Amlani wrote:Hi James,

Thanks for replying. But I've already tried out this solution and I also compared the values.

And do you get the same value from both? If not, then your roll-your-own solution is incorrect.

--> Now, I just got more info that the output which I got, need to be given as an input of the base 64 and I must get the output = "dL7Y8OuzWaxtQJj33gKqEO1rL2diYdurxAM2o//2TRI="
(for the input which I've described in que.)

and currently I am getting "W0JAOTExZjcx".

In your original post post you wanted binary (presumably a byte array) and now you want Base64 encoding. I don't know how you Base64 encoded to get the result "W0JAOTExZjcx" but there is no way that that result is the Base64 encoding of the 20 bytes of the digest. It is in fact the Base64 encoding of "[B@911f71" which is typical of the value obtained from the toString() method of a byte array so it seems you are trying to convert your digest to a string before Base64 encoding it.

Sorry but until you specify exactly what you want and show the code you are currently working with I can't help any further. Please please please get rid of that monstrous roll-your-own HMAC and use that provided by the JCE; I'm not interested in trying to debug code that can be replaced by 4 lines.

[R Amlani]

Ok...now see my this attempt.

I'm giving bytes to the input of base 64. And for base 64 I've written this line of code.

String encoded64 = new String(Base64.encodeBase64(digest)); //digest is in bytes --> output of my sha256.

Now, have a look on this code..

        SecretKey signingKey = new SecretKeySpec("123".getBytes(), "HMACSHA256");
        Mac mac = Mac.getInstance("HMACSHA256");
        mac.init(signingKey);
        digest = mac.doFinal("ABCDEF".getBytes("UTF-8"));     //output of sha256
      
        //1
        String encoded64 = new String(Base64.encodeBase64(digest));   // using it as an input
        System.out.println("direct base64 : "+encoded64);    //not getting desired result

And I'm getting the output = "VsIgGpx6Tq6vNmRyTUK2eLENA85z5ecqUm1F8dqlPZc=" while my required result is "dL7Y8OuzWaxtQJj33gKqEO1rL2diYdurxAM2o//2TRI="

And Previously it was my mistake in giving the input to base64.My sincere apology for that.

[R Amlani]

please give me some hint that how can I get this output (like the example I've given above). As I dont have any requirement specification. I just know that in PHP it can be done using this two lines,

digest_temp = OpenSSL::Digest::Digest.new('sha256')
hmach = OpenSSL::HMAC.digest(digest_temp, @apiprivkey, string_to_sign)

[James Sabre]

R Amlani wrote:
And I'm getting the output = "VsIgGpx6Tq6vNmRyTUK2eLENA85z5ecqUm1F8dqlPZc=" while my required result is "dL7Y8OuzWaxtQJj33gKqEO1rL2diYdurxAM2o//2TRI="

The HMACSHA256 of "ABCDEF" using key "123" is "VsIgGpx6Tq6vNmRyTUK2eLENA85z5ecqUm1F8dqlPZc=".
The HMACSHA256 of "123" using key "ABCDEF" is "dL7Y8OuzWaxtQJj33gKqEO1rL2diYdurxAM2o//2TRI=" .

[R Amlani]

Hi James,

I tried to hash in that way and it worked. I'm really thankful to you sir. Actually it was mistake from the client's documentation.
Now I'll be careful with this kind of issues.

Thanks again.