Java equivalent of Fantom HMAC using SHA1

Question

I'm having trouble doing the following in Java. Below is the Fantom code from the documentation for the the tool I am using.

// compute salted hmac
hmac := Buf().print("$username:$userSalt").hmac("SHA-1", password.toBuf).toBase64

// now compute login digest using nonce
digest := "${hmac}:${nonce}".toBuf.toDigest("SHA-1").toBase64

// our example variables
username: "jack"
password: "pass"
userSalt: "6s6Q5Rn0xZP0LPf89bNdv+65EmMUrTsey2fIhim/wKU="
nonce:    "3da210bdb1163d0d41d3c516314cbd6e"
hmac:     "IjJOApgvDoVDk9J6NiyWdktItl0="
digest:   "t/nzXF3n0zzH4JhXtihT8FC1N3s="

I've been searching various examples through Google but none of them produce the results the documentation claims should be returned.

Can someone with Fantom knowledge verify if the example in the documentation is correct?

As for the Java side, here is my most recent attempt

    public static String hmacSha1(String value, String key) {
    try {
        // Get an hmac_sha1 key from the raw key bytes
        byte[] keyBytes = key.getBytes("UTF-8");           
        SecretKeySpec signingKey = new SecretKeySpec(keyBytes, "HmacSHA1");

        // Get an hmac_sha1 Mac instance and initialize with the signing key
        Mac mac = Mac.getInstance("HmacSHA1");
        mac.init(signingKey);

        // Compute the hmac on input data bytes
        byte[] rawHmac = mac.doFinal(value.getBytes("UTF-8"));

        // Convert raw bytes to Hex
        byte[] hexBytes = new Hex().encode(rawHmac);

        //  Covert array of Hex bytes to a String
        return new String(hexBytes, "UTF-8");
    } catch (Exception e) {
        throw new RuntimeException(e);
    }
}

However, when I call the method with the following parameters

jack:6s6Q5Rn0xZP0LPf89bNdv+65EmMUrTsey2fIhim/wKU=
pass

I get

22324e02982f0e854393d27a362c96764b48b65d

score 2 · Answer 1 · answered Jul 13 '11 at 21:35

Not sure where the docs came from - but they could be out-of-date - or wrong. I would actually run the Fantom code to use as your reference to make sure you're testing the right stuff ;)

You can take a look at the Java source for sys::Buf.hmac: MemBuf.java

I would also recommend separating out the 3 transformations. Make sure your raw byte array matches in both Fantom and Java, then verify the digest matches, and finally the Base64 encoding. Be alot easier to verify each stage in your code.

score 1 · Accepted Answer · answered Jul 15 '11 at 18:19

Turns out it was just my own lack of knowledge and with enough trial and error I was able to figure it out by doing the following:

//username: "jack"
//password: "pass"
//userSalt: "6s6Q5Rn0xZP0LPf89bNdv+65EmMUrTsey2fIhim/wKU="
//nonce:    "3da210bdb1163d0d41d3c516314cbd6e"
//hmac:     "IjJOApgvDoVDk9J6NiyWdktItl0="
//digest:   "t/nzXF3n0zzH4JhXtihT8FC1N3s="

...
// initialize a Mac instance using a signing key from the password
SecretKeySpec signingKey = new SecretKeySpec(password.getBytes(), "HmacSHA1");
Mac mac = Mac.getInstance("HmacSHA1");
mac.init(signingKey);

// compute salted hmac
byte[] hmacByteArray = mac.doFinal((username + ':' + userSalt).getBytes());
String hmacString = new String(Base64.encodeBase64(hmacByteArray));
// hmacString == hmac

// now compute login digest using nonce
MessageDigest md = MessageDigest.getInstance("SHA-1");
md.update((hmacString + ':' + nonce).getBytes());
byte[] digestByteArray = md.digest();
String digestString = new String(Base64.encodeBase64(digestByteArray));
// digestString == digest

Used org.apache.commons.codec.binary.Base64 to encode the byte arrays.

Java equivalent of Fantom HMAC using SHA1

2 Answers2