Base64 HMAC SHA1 String in VBA

Question

I\'m trying to convert an ASP/VBScript OAuth library to VBA. One of the challenges is this line of code:

Get_Signature = b64_hmac_sha1(strSecret, strBaseSign         


        

Answer 1

HMAC is a construct for turning a hash function, like SHA1, into a Message Authentication Code (MAC).

Normal hash functions don't have any secret data associated with it. This means that anyone can compute the digest, assuming they have the original input. HMAC uses a secret key, so that only those in possession of the key can compute outputs.

Suppose I have a file, file.txt. I want to send this to you, and we need to make sure nobody tampers with it. Sorry, I have no clever way to represent this with just text.

me -> file.txt -> you
me -> SHA1(file.txt) -> you

Then you verify the result by computing your own SHA1 digest, and verifying it matches what I sent you.

Now suppose an attacker was in the middle. Unfortunately, because there is no secret involved, the attacker can modify the file, and compute his own file/digest pair. When you compute your version, it'll match what he sent you, and you'll be none the wiser.

me -> file.txt -> attacker -> modified.txt -> you
me -> SHA1(file.txt) -> attacker -> SHA1(modified.txt) -> you

With HMAC, we add a secret key to the computation.

me -> file.txt -> you
me -> SHA1_HMAC(file.txt, our_secret) -> you

When you compute your version, you apply the secret key as well, and the result matches. The attacker, without knowledge of the key, can't replace the digest.

me -> file.txt -> attacker -> modified.txt -> you 
me -> SHA1(file.txt) -> attacker -> SHA1_HMAC(modified.txt, // DOESN'T KNOW KEY) -> you

HMAC is a very specific way of adding the secret key. Unfortunately, simple methods of just concatenating a key to the end of the file, or pre-pending it before hashing, are vulnerable to different attacks (length extension attacks, for example).

The B64 is Base64 encoding the output, to make it pretty.

What this code is ultimately doing is taking some input, and some secret key, and computing a 160-bit digest, and base64 encoding the result.

There is an implementation of SHA1 HMAC in .NET

This looks like an implementation of Base64 for VBA

I hope this answers it well enough, or clear enough. If the text is confusing, please let me know. I tried a couple routes of how to express it, and none of them seemed that clear.

Answer 2

You have written:

It appears to me that calling a JavaScript function from VBA is fairly impractical.

That is a misjudgment.

Javascript can be easily packaged as a Windows Script Component (WSC) and then invokved via COM, from VBA, Perl, VB6, or what-have-you.

Here's an example of packaging Javascript as a WSC and invoking it: https://stackoverflow.com/a/849970/48082

Therefore, your problem should be easily solvable.