Question

我正在连接到使用HMAC身份验证的REST API服务器。尝试使用从命令“ OpenSSL dgst”生成的哈希值，该哈希值已成功连接/认证到服务器。

但是从C＃/。NET使用HMACSHA256和MD5（System.Security.Cryptography）生成的代码与OpenSSL dgst shell脚本命令生成的代码不同，并且身份验证失败

INPUT='teststring'

HMAC_KEY='ASDFGHJKL'

echo "${INPUT}" | openssl dgst -md5 -binary | openssl enc -base64 -A >> log.txt

printf '%s\n' "${INPUT}" | openssl dgst -binary -sha256 -hmac "${HMAC_KEY}" | openssl enc -base64 -A >> log.txt;

生成成功的哈希值以通过邮递员或提琴手连接到服务器

String hmacKey = "ASDFGHJKL";
String md5InputString = "teststring";
String hmacInputString = "teststring\n";
System.Text.UTF8Encoding encoding = new System.Text.UTF8Encoding();
byte[] keyByte = encoding.GetBytes(hmacKey);
MD5 md5 = MD5.Create();
HMACSHA256 hmacsha256 = new HMACSHA256(keyByte);
byte[] utf8EncodedDataBytes = encoding.GetBytes(md5InputString);
byte[] md5HashBytes = md5.ComputeHash(utf8EncodedDataBytes);
string base64md5HashString = Convert.ToBase64String(md5HashBytes);

byte[] utf8EncodedHMACBytes = encoding.GetBytes(hmacInputString);
byte[] hmasha256HashBytes = hmacsha256.ComputeHash(utf8EncodedHMACBytes);
string base64sha256HashString = Convert.ToBase64String(hmasha256HashBytes);

Console.WriteLine("MD5 hash string - " + base64md5HashString);
Console.WriteLine("SHA256 hash string - " + base64sha256HashString);
Console.ReadLine();

与从OpenSSL dgst命令生成的哈希值相比，上述c＃代码生成的哈希值不同

Answer 1

The MD5 and SHA256 matches in both cases for the above code. I am still struggling to solve the issue with hashing which is related to the same question.

 # we read some dummy data that will be hashed
#PAYLOAD='teststring'
read -r -d '' PAYLOAD << EOF
{
  "type": "MatchType",
  "membershipId": "1234567890",
  "givenName": "FirstName",
  "surname": "LastName"
}
EOF
HMAC_KEY='ADf3TSCGjNd4Zj29'
# the verb 
VERB='POST'
# the full resource URL 
RESOURCE='/v1/member/profile/validate'
# a generated timestamp used to prevent replay 
TIMESTAMP=$(date -u +'%Y-%m-%dT%H:%M:%SZ')
CONTENT_TYPE='application/json'
# generate the content length
CONTENT_LENGTH=$( echo -n "${PAYLOAD}" | wc -c )
CONTENT_DIGEST=$(echo -n "${PAYLOAD}" | openssl dgst -md5 -binary | openssl enc -base64 -A)
printf  "\nPayload MD5 hash input string\n"  >> log.txt;
echo -n "${PAYLOAD}"  >> log.txt;
printf  "\nMD5 Base64Encoded string\n"  >> log.txt;
echo -n "${PAYLOAD}" | openssl dgst -md5 -binary | openssl enc -base64 -A >> log.txt

printf  "\nHMAC hash input string\n"  >> log.txt;
printf '%s\n%s\n%s\n%s\n%s' "${VERB}""${TIMESTAMP}""${RESOURCE}""${CONTENT_TYPE}""${CONTENT_DIGEST}"  >> log.txt;
printf  "\nHMAC Base64Encoded string\n"  >> log.txt;
printf '%s\n%s\n%s\n%s\n%s' "${_VERB}""${_TIMESTAMP}""${_RESOURCE}""${_CONTENT_TYPE}""${_CONTENT_DIGEST}" | openssl dgst -binary -sha256 -hmac "${HMAC_KEY}" | openssl enc -base64 -A >> log.txt;

This outputs

Payload MD5 hash input string

{ "type": "MatchType", "membershipId": "1234567890", "givenName": "FirstName", "surname": "LastName" }

MD5 Base64Encoded string

MkY18c4MmVoS2r66DSNgRQ==

HMAC hash input string

POST2019-06-01T14:04:47Z/v1/member/profile/validateapplication/jsonMkY18c4MmVoS2r66DSNgRQ==

HMAC Base64Encoded string

BlfQhEyX5tRDl7bpDS0PVmFUm4QBn3r7KazOIfG/1JQ=

string hmacKey = "ADf3TSCGjNd4Zj29";
string stringjsonData = "{\"type\": \"MatchType\",\"membershipId\": \"1234567890\",\"givenName\": \"FirstName\",\"surname\": \"LastName\"}";
//string stringjsonData = "teststring";
int jsonStringLength = stringjsonData.Length;
string verb = "POST";
string datetime = "2019-06-01T14:04:47Z";
string url = "/v1/member/profile validate";
string contenttype = "application/json";

System.Text.UTF8Encoding encoding = new System.Text.UTF8Encoding();
byte[] keyByte = encoding.GetBytes(hmacKey);
MD5 hmacmd5 = MD5.Create();
HMACSHA256 hmacsha256 = new HMACSHA256(keyByte);

byte[] utf8EncodedMD5DataBytes = encoding.GetBytes(stringjsonData);
byte[] hmacmd5HashBytes = hmacmd5.ComputeHash(utf8EncodedMD5DataBytes);
string base64md5HashString = Convert.ToBase64String(hmacmd5HashBytes);

string sha256Input = verb + "\n " + datetime + "\n " + url + "\n " + contenttype + "\n " + base64md5HashString;

byte[] utf8EncodedSHA256DataBytes = encoding.GetBytes(sha256Input);
byte[] hmasha256HashBytes = hmacsha256.ComputeHash(utf8EncodedSHA256DataBytes);
string base64sha256HashString = Convert.ToBase64String(hmasha256HashBytes);

Console.ReadLine();

The Hash generated from c# code are

MD5 Base64Encoded string RrKDQmKSdDnByqlFiMcTOA==

SHA256 Base64Encoded string J9S5IrnFuzwZrCqAVxcaL30xDCrZnyBpu9NHGFpHSQw=

Please note I am using the exact date from the output of the script as the date in the C# program.

HMACSHA256和MD5生成的哈希与openssl dgst生成的哈希不同

1 个答案: