Javascript HMAC and Python HMAC not returning same hash

Question

I currently have a Javascript code that looks like this

var CryptoJS = require("crypto-js");

var key = "bookbookbook";
var msg = "2020-06-16 20:03:19";

var signature = CryptoJS.HmacSHA1(msg, key);
var checksum = CryptoJS.enc.Utf8.parse(signature);

console.log("checksum: " + CryptoJS.enc.Base64.stringify(checksum));

the checksum is ODNjOWY5NThmYzUxODNkYWM1MjhjZTY3ZTYzYmQxNjE1ZDRkZDQ5Zg==

I tried to convert it to Python

import base64
import time
import hmac
import hashlib

key = "bookbookbook".encode(encoding='utf-8')
msg = "2020-06-16 20:03:19".encode(encoding='utf-8')

digest = hmac.new(key, msg, hashlib.sha1).digest()
checksum = base64.b64encode(digest).decode('utf-8')

print(checksum)

but the checksum returned is this g8n5WPxRg9rFKM5n5jvRYV1N1J8=

How do I make it return the same?

Just a small note: your variable name seems misleading, it is not actually a checksum, but encrypted data — Kaddath
– Kaddath, Commented Jun 16, 2020 at 8:42
@Ry- I did, it displayed the wordArray, which is not really what I wanted, hence why I did the encoding to Base64 string. The problem is the Python part, I have no idea how to do it at all :( — Jonathan Ho
– Jonathan Ho, Commented Jun 16, 2020 at 9:14

Kaddath · Accepted Answer · 2020-06-16 12:36:28Z

1

this step is unnecessary and transforms your data, making the result wrong: var checksum = CryptoJS.enc.Utf8.parse(signature); (Utf8.parse is used to convert an UTF-8 string to wordsArray, but you already have a wordsArray as a result from CryptoJS.HmacSHA1's call)

Your code should be: (took responsability to change variables names to something more proper)

var CryptoJS = require("crypto-js");

var key = "bookbookbook";
var msg = "2020-06-16 20:03:19";

var encrypted = CryptoJS.HmacSHA1(msg, key);

console.log("encrypted in Base64: " + CryptoJS.enc.Base64.stringify(encrypted));

see it in action in a fiddle, you'll see same result as the python code

edited Jun 16, 2020 at 12:36

answered Jun 16, 2020 at 12:27

Kaddath

6,1511 gold badge11 silver badges24 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Jonathan Ho Over a year ago

This is great! But... I think this is going the wrong direction; you're trying to change the Javascript code, while what I needed was the other way around. What I'm trying to do is port the Javascript code into Python. From the clues I gathered from your code, I'm guessing I need to encode the wordsarray to utf8, and from utf8 to base64 string

Kaddath Over a year ago

@JonathanHo That's not meant to be nasty or sarcastic, but I would think your approach is going the wrong direction rather. There's obviously a mistake in the original code, it's a good occasion to correct it instead of trying to reproduce it with another language. How are you going to decrypt the value, because you won't get the original message, it has been transformed by the faulty line. Trying to analyze what Utf8.parse does to your wordsArray and reproduce it in python may prove harder and longer than to correct the original mistake..

Kaddath Over a year ago

It would be useful to know how you are using this encrypted value on the other end, because if you are using it as a checksum, encryption is not the right tool to use

Jonathan Ho · Accepted Answer · 2020-06-18 00:33:25Z

0

I found the solution. Although I do agree with Kaddath the Javascript sucks, I'm unable to alter it due to the fact that 1) it has been been used and running for several years and 2) I'm doing a port to Python, not fixing/updating the original code and 3) "da bossman" says just port not fix

Here's the Python code that produces the same output:

import base64
import time
import hmac
import hashlib
import binascii

key = "bookbookbook".encode(encoding='utf-8')
msg = "2020-06-16 20:03:19".encode(encoding='utf-8')

digest = hmac.new(key, msg, hashlib.sha1).digest()

checksum = base64.b64encode(binascii.hexlify(bytearray(digest)))
print("checksum: ", checksum.decode('utf-8'))

answered Jun 18, 2020 at 0:33

Jonathan Ho

112 bronze badges

Collectives™ on Stack Overflow

Javascript HMAC and Python HMAC not returning same hash

2 Answers 2

3 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

3 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related