Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Why does encrypting HMAC-SHA1 in exactly the same code in C# and PowerShell show different results?

I've been trying to encrypt a Amazon S3-like authorization key with HMAC-SHA1 in PowerShell with the following code:

$str="PUT\n\napplication/x-zip-compressed\nThu, 09 Feb 2017 08:59:43 GMT\n/test-bucket/test-key"
$secret="c334da95a6734ff4a04abd99efca450f"
$sha = [System.Security.Cryptography.KeyedHashAlgorithm]::Create("HMACSHA1")
$sha.Key = [System.Text.Encoding]::UTF8.Getbytes($secret)
$sign = [Convert]::Tobase64String($sha.ComputeHash([System.Text.Encoding]::UTF8.Getbytes(${str})))
echo $sign

This code outputs NcJQ1MapHbyRwC2FzvABYyte5uY=, which is incorrect according to our service provider's suggestion.

Then I tried to use exactly the same classes in C# code:

static void Main(string[] args)
{
    var str = "PUT\n\napplication/x-zip-compressed\nThu, 09 Feb 2017 08:59:43 GMT\n/test-bucket/test-key";
    var secret = "c334da95a6734ff4a04abd99efca450f";

    var sha = System.Security.Cryptography.KeyedHashAlgorithm.Create("HMACSHA1");
    sha.Key = System.Text.Encoding.UTF8.GetBytes(secret);
    Console.WriteLine(Convert.ToBase64String(sha.ComputeHash(System.Text.Encoding.UTF8.GetBytes(str)))); //1S+/P9zgcCCyjwUK1bPKaKeya7A=
    Console.Read();
}

Oddly enough, this time, the result is correct: 1S+/P9zgcCCyjwUK1bPKaKeya7A=

I also tried Python, and it vindicated the C# code. Why did PowerShell run into an incorrect answer even though the inputs, classes and the methods are exactly the same with those which are called in C# code?

like image 330
Aries Avatar asked Feb 10 '17 02:02

Aries


People also ask

Is SHA1 secure for HMAC?

Although NIST has formally deprecated use of SHA-1 for digital signatures, SHA-1 is still considered secure for HMAC as the security of HMAC does not rely on the underlying hash function being resistant to collisions.

Is HMAC MD5 secure?

For HMAC-MD5 the RFC summarizes that – although the security of the MD5 hash function itself is severely compromised – the currently known "attacks on HMAC-MD5 do not seem to indicate a practical vulnerability when used as a message authentication code", but it also adds that "for a new protocol design, a ciphersuite ...

Why do we need HMAC?

Hash-based message authentication code (or HMAC) is a cryptographic authentication technique that uses a hash function and a secret key. With HMAC, you can achieve authentication and verify that data is correct and authentic with shared secrets, as opposed to approaches that use signatures and asymmetric cryptography.


1 Answers

It's because the escape character in PowerShell is ` while the one in C# is \.

$str = "PUT`n`napplication/x-zip-compressed`nThu, 09 Feb 2017 08:59:43 GMT`n/test-bucket/test-key"

Should yield the expected result.

like image 148
Igor Avatar answered Oct 31 '22 08:10

Igor