Library for generating HMAC-SHA1 OAuth signature on Android?

Question

Using the specifications below I need to create an oauth_signature on Android. I'm looking for a library that handles the boiler plate code in creating a signature for accessing resources via OAuth.

1. Construct a signature "base string", which consists of a concatenation of three request elements:

   • The HTTP request method.
   • The base URL the request is being sent to. This URL should not include any query parameters. When signing calls to Google services, refer to the OAuth specification, Section 9.1.2, for relevant instructions.
   • A normalized string of the parameters in the request (excluding the oauth_signature parameter). This includes parameters sent in the request header or body, as well as query parameters added to the request URL. To normalize the string, sort the parameters using lexicographical byte value ordering. For more details on normalizing this string, see Section 9.1.1 of the OAuth specification.

2. Generate an oauth_signature using one of the following sequences:

   • If your application is registered and you're using HMAC-SHA1, use the OAuth "consumer secret" value generated during registration; this value is displayed on your domain's registration page.

Answer 1

In answer to Will's question on Chris's answer, you could use the built in android javax.crypto.mac to generate the hmacsha1 signature using following code (standard Java JCE provider apis):

Mac mac = Mac.getInstance("HmacSHA1");
SecretKeySpec secret = new SecretKeySpec(key.getBytes(), mac.getAlgorithm());
mac.init(secret);
byte[] digest = mac.doFinal(baseString.getBytes());
byte[] result=Base64.encode(digest, DEFAULT);

Where 'secret' would be you text you wanted to encode and 'result' above would be your hash encoded signature.

Answer 2

I don't know anything about OAuth, but you can use javax.crypto.Mac to generate HMAC-SHA1 value (use HmacSHA1 as the algorithm name):

Mac hmac = Mac.getInstance("HmacSHA1");