RE: HMAC calculation -- MIDRANGE-L

Sorry - it was 64 and not 60
Heres my code
H Bnddir('QC2LE':'RXSBND':'HBMOBND':'STRINGSP')
H dftactgrp(*no) actgrp('QILE')
H option(*srcstmt:*nodebugio)
? * PROGRAM STATUS DATA STRUCTURE
? /copy copybook,psds
?
? ** PROTOTYPES
/include protype,stringpr
?
? *---------------------------------------------------------------------
? * Stand Alone Fields - TOP
? *---------------------------------------------------------------------
d dataToHash s 500a
d Nullfield s 1000a
d SecretSharedKey...
d s 64
d ConvSecretSharedKey...
d s like(SecretSharedKey)
d HldConvSecretSharedKey...
d s like(SecretSharedKey)
d HldFromCCSID s 5 0
d HldToCCSID s 5 0
d SHA_1 c const(2)
d SHA_256 c const(3)
d binaryHMAC s 500A
d ConvdataToHash...
d s 500a
d HldConvdataToHash...
d s like(ConvdataToHash)
D DataLen s 10i 0
d FinalASCIIHMAC s like(binaryHMAC)
d FinalEBCDICHMAC...
d s like(binaryHMAC)
D HexEquivalent s like(binaryHMAC)
? *---------------------------------------------------------------------
? * Stand Alone Fields - BOTTOM
? *---------------------------------------------------------------------
D ErrorCode DS qualified
D bytesProv 10i 0 inz(0)
D bytesAvail 10i 0 inz(0)
D HldErrorcode DS likeds(ErrorCode)

D my_key DS qualified
D Type 10i 0 inz(SHA_256)
D Len 10i 0
D Fmt 1a inz('0')
D 3a
D Value 92a

D Qc3CalculateHMAC...
D pr extproc('Qc3CalculateHMAC')
D pinData 32767a const options(*varsize)
D pinDataLen 10i 0 const
D pinFormat 8a const
D palgDesc 10i 0 const
D palgDescFmt 8a const
D pkeyDesc 32767a const options(*varsize)
D pkeyDescFmt 8a const
D pcryptoProv 1a const
D pcryptoDev 20a const
D pHMAC 32767a options(*varsize)
D pErrorCode 32767a options(*varsize)

D ToHex PR EXTPROC('cvthc')
D HexResult 65534A OPTIONS(*VARSIZE)
D CharInp 32767A OPTIONS(*VARSIZE)
D CharNibbles 10I 0 VALUE

? *****************************************************************

/free
//dataToHash =
//'NBTYd00149settle2017-06444433bbbbbbbbc1111purchasekeyed33261Payment -
? //for order number1000005280826D12345';
Nullfield = *allx'00';
SecretSharedKey = 'Jefe';
dataToHash = 'what do ya want for nothing?';
HldFromCCSID = 37;
HldToCCSID = 1208;
HldConvSecretSharedKey = convertCCSID(%trim(SecretSharedKey):
HldFromCCSID:
HldToCCSID);
ConvSecretSharedKey = %trim(HldConvSecretSharedKey) + Nullfield;
HldConvdataToHash = convertCCSID(%trim(dataToHash):
HldFromCCSID:
HldToCCSID);
ConvdataToHash = %trim(HldConvdataToHash) + Nullfield;

my_key.len = %size(ConvSecretSharedKey);
my_key.value = (ConvSecretSharedKey) + Nullfield;
DataLen = %len(ConvdataToHash);
monitor;
Qc3CalculateHMAC( ConvdataToHash
: DataLen
: 'DATA0100'
: SHA_256
: 'ALGD0500'
: my_key
: 'KEYD0200'
: '0'
: *blanks
: binaryHMAC
: ErrorCode );
on-error;
HldErrorcode = ErrorCode;
endmon;

? *inlr = '1';
return;
/end-free

Alan Shore
Programmer/Analyst, Direct Response
E:AShore@xxxxxxxx
P:(631) 200-5019
C:(631) 880-8640
"If you're going through Hell, keep going" - Winston Churchill

-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Tim Bronski
Sent: Tuesday, January 29, 2013 8:42 AM
To: Midrange Systems Technical Discussion
Subject: Re: HMAC calculation

64.
What size are you specifying on the call to Qc3Calc...and the alg is set to sha256?
Can you post your code?

On 1/29/2013 2:36 PM, Alan Shore wrote:

As if by magic....
Hi Tim
The result of my Qc3CalculateHMAC was different than on the web page, so I changed the key size from 36 to 60 as you said on a prior e-mail.
No difference - I get the exact same result The sound you are hearing
in the far off distance is NOT that of approaching thunder, but me
banging my head against a brick wall

Alan Shore
Programmer/Analyst, Direct Response
E:AShore@xxxxxxxx
P:(631) 200-5019
C:(631) 880-8640
"If you're going through Hell, keep going" - Winston Churchill

-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx
[mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Tim Bronski
Sent: Tuesday, January 29, 2013 8:33 AM
To: Midrange Systems Technical Discussion
Subject: Re: HMAC calculation

Key field size?

On 1/29/2013 1:58 PM, Alan Shore wrote:

Hi Peter
I spoke too soon.
Right now I am looking for my noose so that I can hang myself.

This is my code
d SecretSharedKey...
d s 36
d ConvSecretSharedKey...
d s like(SecretSharedKey)
d HldConvSecretSharedKey...
d s like(SecretSharedKey)
d ConvdataToHash...
d s 500a
d HldConvdataToHash...
d s like(ConvdataToHash)
SecretSharedKey = 'Jefe';
dataToHash = 'what do ya want for nothing?'; HldFromCCSID = 37;
HldToCCSID = 1208;
HldConvSecretSharedKey = convertCCSID(%trim(SecretSharedKey):
HldFromCCSID:
HldToCCSID);
ConvSecretSharedKey = %trim(HldConvSecretSharedKey) + *loval;
HldConvdataToHash = convertCCSID(%trim(dataToHash):
HldFromCCSID:
HldToCCSID);
ConvdataToHash = %trim(HldConvdataToHash) + *loval;

And it wont compile.
*RNF7421 30 2 Operands are not compatible with the type of operator.
I have changed the lines and remove the + *loval and the program
compiles I have tried *allx'00'; instead of *loval I have even tried
*null Same error

Alan Shore
Programmer/Analyst, Direct Response
E:AShore@xxxxxxxx
P:(631) 200-5019
C:(631) 880-8640
"If you're going through Hell, keep going" - Winston Churchill

-----Original Message-----
From: Alan Shore
Sent: Tuesday, January 29, 2013 7:23 AM
To: midrange-l@xxxxxxxxxxxx
Subject: RE: HMAC calculation

Peter
MUCH appreciated

Alan Shore
Programmer/Analyst, Direct Response
E:AShore@xxxxxxxx
P:(631) 200-5019
C:(631) 880-8640
"If you're going through Hell, keep going" - Winston Churchill

-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx
[mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Peter Dow
Sent: Tuesday, January 29, 2013 3:26 AM
To: midrange-l@xxxxxxxxxxxx
Subject: Re: HMAC calculation

If your NewValue field is defined as VARYING you could use:

MyField = NewValue + *LOVAL;

MyField = NewValue + *ALLX'00';

If it's not VARYING, use %trim, or %trimr to make it VARYING:

MyField = %trimr(NewValue) + *LOVAL;

--
*Peter Dow* /
Dow Software Services, Inc.
909 793-9050
petercdow@xxxxxxxxx <mailto:petercdow@xxxxxxxxx> pdow@xxxxxxxxxxxxxx
<mailto:pdow@xxxxxxxxxxxxxx>/

On 1/28/2013 2:03 PM, Alan Shore wrote:

Hi
I am in the process of using the link
https://tools.ietf.org/html/rfc4231 (i.e use the test data and keys and check you get the correct output).
And in a later e-mail Tim Bronski wrote And when you're running
these tests, remember that the key size for
sha256 is 64 bytes and if the key is shorter (as it is in some
tests) pad to the right with nulls (x'00's).
How do you pad to the right with nulls (x'00's.) in RPG.
For example - I am starting with 4.3 Test case 2 My key in EBCDIC I
s "Jefe" which I am converting to CCSID 1208 and the resultant field
- in debug, hexadecimal, is EVAL ConvSecretSharedKey :x
00000 4A656665 40404040 40404040 40404040 - ¢ÁÃÁ
00010 40404040 40404040 40404040 40404040 -
00020 40404040 ........ ........ ........ - ............
The beginning is correct (4A656665), but there are trailing blanks

Alan Shore
Programmer/Analyst, Direct Response
E:AShore@xxxxxxxx
P:(631) 200-5019
C:(631) 880-8640
"If you're going through Hell, keep going" - Winston Churchill

-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx
[mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Tim Bronski
Sent: Saturday, January 26, 2013 9:14 AM
To: Midrange Systems Technical Discussion
Subject: Re: HMAC calculation

Firstly, have you verified your hmac code? If not go here and test against the vectors provided.
https://tools.ietf.org/html/rfc4231 (i.e use the test data and keys and check you get the correct output).

If you've got that ok....I'd be concerned when you say you're providing the xml in EBCDIC. Somewhere I'm certain it's being xlated. Your mac needs to be calculated over the EXACT same binary stream as it is on the remote end. Having it xlated in two different places is asking for trouble. The key should be the same bit string on either end too.

Can I ask who you're sending this to?

On 1/25/2013 10:44 PM, Alan Shore wrote:

Hi everyone
Hopefully someone will take pity on me and provide some answers
(I'm trying to get the sympathy vote) Before I forget, as I usually
do, we are on V5r4.

As part of a web service, I have to provide an authentication token
which "is calculated using the HMAC (keyed-Hash Message
Authentication
Code) algorithm. This is a type of message authentication code (MAC) calculated using a specific algorithm involving a cryptographic hash function in combination with a secret key (the shared secret)."
The result of this is to be Hex encoded What I have done is used
the API Qc3CalculateHMAC for SHA_256 (prior e-mail submitted and
people have graciously responded) The result of this calculation is
then to be Hex encoded, so I have then used a service program that utilizes QtqIconvOpen, iconv and iconv_close.
The transmission of this data is being rejected due to the HMAC hex encoded field being incorrect.
I then discovered that the site I am transmitting to is "a Linux system so we are working in ASCII. Use UTF-8." As I was told.
So I thought that I would need to covert the string (and the secret
shared password) into the API Qc3CalculateHMAC into UTF-8 (CCSID 1208) - then use the service program that utilizes QtqIconvOpen, iconv and iconv_close.
However, the rest of the web_service transmission contains EBCDIC
values, so I assumed that the Hex encoded value had to be converted
BACK to EBCDIC so that the XML transmission would ALL be in EBCDIC
to be translated to UTF-8 as part of the transmission To cut a LOOOOOOOOONG story short, I have tried so many permutations and combinations of what is to be iconved before and after the Qc3CalculateHMAC I don't know where I am Needless to say ALL of my test transmissions have failed If anyone has a clearer had than me (who hasn't) and can point me in a good direction, I would be VERY grateful.

Alan Shore
Programmer/Analyst, Direct Response E:AShore@xxxxxxxx
P:(631) 200-5019
C:(631) 880-8640
"If you're going through Hell, keep going" - Winston Churchill

Disclaimer: This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. E-mail transmission cannot be guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. The sender therefore does not accept liability for any errors or omissions in the contents of this message, which arise as a result of e-mail transmission. If verification is required please request a hard-copy version. Any views or opinions presented are solely those of the author and do not necessarily represent those of the company.

--
Need secure FTP? Forget PASE...get your FREE sFTP here
www.arpeggiosoftware.com
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L)
mailing list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To
subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a moment to review the archives at http://archive.midrange.com/midrange-l.

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe,
unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a moment to review the archives at http://archive.midrange.com/midrange-l.

--
Need secure FTP? Forget PASE...get your FREE sFTP here www.arpeggiosoftware.com
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a moment to review the archives at http://archive.midrange.com/midrange-l.