手动 HMACSHA1 计算与 openssl 结果不同

Question

我正在尝试手动实施 HMACSHA1，以检查我们的服务提供商或我们是否为支持票据计算了错误的 HMAC（SOAP 调用，因此 xml 内容）。

问题是，我坚持 HMAC 的 NIST 规范并通过 Hand 和使用 openssl HMAC 函数得到不同的结果。

打印以下代码：

B92674DCBA96F2DA93F7043071B931F5F2583FBD
4303E965D88D288C9AC594CE6C5E6AFF27D40B2D

虽然 openssl 的结果与我们在应用程序中得到的结果相同 - 所以我假设，基于 openssl 如此常用，我的结果是错误的 - 但我的错误在哪里？

这是我参考的规范： http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.198-1.pdf

这是我的代码：

#include <stdio.h>
#include <stdlib.h>
#include <openssl/sha.h>
#include <openssl/hmac.h>
#include <string.h>

#define byte unsigned char
#define IPAD 0x36
#define OPAD 0x5c
#define DIGESTSIZE 20



int main () {
    byte *derivedKey =  (byte[DIGESTSIZE]) {0x42,0xA9,0x78,0x90,0xFC,0xE5,0x16,0x8E,0x58,0x12,0x2F,0xF1,0xBA,0x32,0x5F,0x09,0x88,0x94,0x02,0x91};
    byte *content =     "<ds:SignedInfo xmlns:ds=\"http://www.w3.org/2000/09/xmldsig#\" xmlns:soap=\"http://www.w3.org/2003/05/soap-envelope\"><ds:CanonicalizationMethod Algorithm=\"http://www.w3.org/2001/10/xml-exc-c14n#\"><ec:InclusiveNamespaces xmlns:ec=\"http://www.w3.org/2001/10/xml-exc-c14n#\" PrefixList=\"soap\"></ec:InclusiveNamespaces></ds:CanonicalizationMethod><ds:SignatureMethod Algorithm=\"http://www.w3.org/2000/09/xmldsig#hmac-sha1\"></ds:SignatureMethod><ds:Reference URI=\"#TS-B183A13FEB0189143115136776276601\"><ds:Transforms><ds:Transform Algorithm=\"http://www.w3.org/2001/10/xml-exc-c14n#\"><ec:InclusiveNamespaces xmlns:ec=\"http://www.w3.org/2001/10/xml-exc-c14n#\" PrefixList=\"wsse soap\"></ec:InclusiveNamespaces></ds:Transform></ds:Transforms><ds:DigestMethod Algorithm=\"http://www.w3.org/2000/09/xmldsig#sha1\"></ds:DigestMethod><ds:DigestValue>rXJdGuDqoRrUJxuGiA1eyAozifk=</ds:DigestValue></ds:Reference></ds:SignedInfo>";
    byte *oPadKey =     malloc(DIGESTSIZE);
    byte *iPadKey =     malloc(DIGESTSIZE);


    int i;
    for(i=0;i<DIGESTSIZE;i++){
        iPadKey[i]=derivedKey[i]^IPAD;
        oPadKey[i]=derivedKey[i]^OPAD;
    }

    byte *rOpInput=     malloc(strlen(content)+DIGESTSIZE);

    //concat iPad and content
    memcpy(rOpInput, iPadKey, DIGESTSIZE);
    memcpy(rOpInput+DIGESTSIZE,content,strlen(content));

    //SHA1 (iPad||content) gives the rightmost 20 bytes of the final SHA1 Input
    byte *rOp=malloc(DIGESTSIZE); // H(iPad||content)
    SHA1(rOpInput,strlen(content)+DIGESTSIZE,rOp);
    free(rOpInput);

    byte *finalInput = malloc(2*DIGESTSIZE); //oPad||H(iPad||content)

    //concat oPad and H(ipad||content)
    memcpy(finalInput, oPadKey,DIGESTSIZE);
    memcpy(finalInput+DIGESTSIZE,rOp,DIGESTSIZE);

    free(rOp);
    free(oPadKey);
    free(iPadKey);
    //SHA1(oPad||H(iPad||content))

    byte *hmac = malloc(DIGESTSIZE);
    SHA1(finalInput,40,hmac);
    free(finalInput);

    //print calculated HMAC as HEX
    for(i=0;i<DIGESTSIZE;i++){
        printf("%02X", (hmac[i] & 0xFF ));
    }
    printf("\n");


    //verify with openssl HMAC
    byte *result = HMAC(EVP_sha1(), derivedKey, DIGESTSIZE, content, strlen(content), NULL, NULL);
    for(i=0;i<DIGESTSIZE;i++){
        printf("%02X", (result[i] & 0xFF ));
    }
    printf("\n");
    return 0;
}

Answer 1

错误简单。 ipad 和 opad 的长度需要 (input) block size，而不是摘要输出的长度。 IE。对于 SHA-1，它们必须是 512 位（64 字节），而不是 20。

即

#define INPUT_BLOCK_SIZE 64
byte derivedKey[64] =  {0x42,0xA9,0x78,0x90,0xFC,0xE5,0x16,0x8E,0x58,0x12,
                        0x2F,0xF1,0xBA,0x32,0x5F,0x09,0x88,0x94,0x02,0x91};
// null-padded on the right

然后将 DIGESTSIZE 更改为 INPUT_BLOCK_SIZE，以便在需要 ipad、opad 长度的地方。

结果：

4303E965D88D288C9AC594CE6C5E6AFF27D40B2D

来自 Wikipedia

K' is another secret key, derived from the original key K (by padding K to the right with extra zeroes to the input block size of the hash function, or by hashing K if it is longer than that block size)

（强调我的）.

P.S。最好使用 SHA1_Init/Update/Final，因为这样会跳过很多复制。您还可以避免为 ipad 和 opad 分别分配内存，方法是首先计算 ipad 并在使用它之后，然后通过 0x6a 进行异或以获取 opad。

Answer 2

请参考这个。您可以轻松计算哈希

https://csrc.nist.gov/CSRC/media/Projects/Cryptographic-Standards-and-Guidelines/documents/examples/HMAC_SHA1.pdf

Answer 3

 #define IPAD 0x36

 #define OPAD 0x5c

 #define DIGESTSIZE 20

 #define INPUT_BLOCK_SIZE 64

 #define byte unsigned char

static byte mykey[64];

int main () {

int i;

    byte mykey[INPUT_BLOCK_SIZE] = {

0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F,
0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E, 0x1F, 0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27,
0x28, 0x29, 0x2A, 0x2B, 0x2C, 0x2D, 0x2E, 0x2F, 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37,0x38, 0x39, 0x3A, 0x3B, 0x3C, 0x3D, 0x3E, 0x3F };

    byte content[] = {0x53, 0x61, 0x6D, 0x70, 0x6C, 0x65, 0x20, 0x6D, 0x65, 0x73,
0x73, 0x61, 0x67, 0x65, 0x20, 0x66, 0x6F, 0x72, 0x20, 0x6B, 0x65, 0x79, 0x6C, 0x65, 0x6E, 0x3D, 0x62, 0x6C, 0x6F, 0x63, 0x6B, 0x6C, 0x65, 0x6E };

   byte k0_ipad_text[sizeof(content) + INPUT_BLOCK_SIZE];
   byte hmac[DIGESTSIZE];
   byte k0_opad_hash[INPUT_BLOCK_SIZE + DIGESTSIZE];

/*
 * K0 is mykey as size is 0x40 = 64 bytes
 */

    byte *oPadKey =     malloc(INPUT_BLOCK_SIZE);
    byte *iPadKey =     malloc(INPUT_BLOCK_SIZE);

     memset(oPadKey, 0, INPUT_BLOCK_SIZE);
     memset(iPadKey, 0, INPUT_BLOCK_SIZE);

    for(i=0;i<INPUT_BLOCK_SIZE;i++){
        iPadKey[i]=mykey[i]^IPAD;
        oPadKey[i]=mykey[i]^OPAD;
    }

    printf("\n iPad key = ");
    for(i=0;i<INPUT_BLOCK_SIZE;i++){
    printf("%02x ", iPadKey[i]);
    }

    printf("\n oPad key = ");
    for(i=0;i<INPUT_BLOCK_SIZE;i++){
    printf("%02x ", oPadKey[i]);
    }

//Key^ipad)||text)

    memcpy(k0_ipad_text, iPadKey, INPUT_BLOCK_SIZE);
    memcpy(k0_ipad_text + INPUT_BLOCK_SIZE, content, sizeof(content));

    SHA1(k0_ipad_text, INPUT_BLOCK_SIZE + sizeof(content), hmac);
#if 0
    printf("\n hmac  = ");
    for(i=0;i<DIGESTSIZE;i++){
    printf("%02x ", hmac[i]);
    }
#endif

    memcpy(k0_opad_hash, oPadKey, INPUT_BLOCK_SIZE);
    memcpy(k0_opad_hash + INPUT_BLOCK_SIZE, hmac, DIGESTSIZE);

    SHA1(k0_opad_hash, INPUT_BLOCK_SIZE + DIGESTSIZE, hmac);
    printf("\n hmac \n");
    for(i=0;i<DIGESTSIZE;i++){
    printf("%02x", hmac[i]);
    }

   printf("\n");

    //verify with openssl HMAC
    byte *result = HMAC(EVP_sha1(), mykey, INPUT_BLOCK_SIZE, content, sizeof(content), NULL, NULL);
    for(i=0;i<DIGESTSIZE;i++){
        printf("%02X", (result[i] & 0xFF ));
    }

    printf("\n");
    return 0;
}

手动 HMACSHA1 计算与 openssl 结果不同

Manual HMACSHA1 calculation differs from openssl results

c

openssl

hmac