Computing an HMAC-SHA signature

Question

I'm writing a module for Amazon's SimpleDB. They require REST requests to be signed using HMAC-SHA algorithm. (Details here.)

I'm told that there is a function to computer this signature, but I can't find it in the documentation. What is the function called, and what do its arguments look like?

See http://ktest.heroku.com/a421x67 https://gist.github.com/980000 — Randall Bohn, May 19 '11 at 01:51

Anders Lindahl · Answer 1 · 2011-04-11T19:27:07.013

1

The HMAC is a standard function that can be found in crypto libraries for most platforms. Amazon shows several examples on the documentaion page you link to.

For Java, you can find it in javax.crypto.Mac

For .Net, look in System.Security.Cryptography

For KRL, I haven't found any built-in stock solution. Since it seems possible to embed javascript, the jsSHA implemenation could be useful. There is a sha1 function in the math library, and implementing HMAC according to RFC2104 doesn't seem that difficult.

edited Apr 11 '11 at 19:27

answered Apr 11 '11 at 18:35

Anders Lindahl

41,582
9
89
93

Thanks. I'm looking for information on the function in KRL (hence the KRL tag). – Steve Nay Apr 11 '11 at 18:36
Oh, never heard of it. Looks interesting, I'll look around and update my answer if I find anything. – Anders Lindahl Apr 11 '11 at 18:53

Randall Bohn · Accepted Answer · 2011-04-15T03:12:30.300

1

EDITED: The following should work:

pre {
  message = "Four score and seven years ago";
  key = "Abe Lincoln";
  signature = math:hmac_sha256_base64(message, key);
}
notify("Signature is", signature);

The function is math:hmac_sha256_base64(<datastring>,<keystring>)

edited Apr 15 '11 at 03:12

answered Apr 12 '11 at 17:55

Randall Bohn

2,597
2
16
20

Thanks, Randall. I'm still having trouble getting it to actually work with AWS, but that is the right syntax. – Steve Nay Apr 15 '11 at 13:24

Randall Bohn · Answer 3 · 2011-05-21T02:32:41.670

To sign strings with embedded newlines (AWS I'm talking to you!) you have to do the following (based on the AWS S3 example)

pre {
  raw_string = uri:unescape("GET%0A%0A%0AWed, 28 Mar 2007 01:29:59 +0000%0A/");
  sample_key = "uV3F3YluFJax1cknvbcGwgjvx4QpvB+leU8dUj2o";
  signature = math:hmac_sha1_base64(raw_string, sample_key);
  expected = "Db+gepJSUbZKwpx1FR0DLtEYoZA=";
  passfail = (signature eq expected) => "pass" | "fail";
}

The uri:decode() function returns a string with proper newlines, where \n\n\n does not. You might have to add trailing '=' to the signature.

Computing an HMAC-SHA signature

3 Answers3