iPhone and HMAC-SHA-1 encoding

Question

im trying to get a call to amazon web service and im stuck on getting the signature, looked at this but i still have a question on it.

using this example what is the

NSData *keyData;
NSData *clearTextData

? what do i need to pass for these two values?

/*
  inputs:
  NSData *keyData;
  NSData *clearTextData
*/

uint8_t digest[CC_SHA1_DIGEST_LENGTH] = {0};

CCHmacContext hmacContext;
CCHmacInit(&hmacContext, kCCHmacAlgSHA1, keyData.bytes, keyData.length);
CCHmacUpdate(&hmacContext, clearTextData.bytes, clearTextData.length);
CCHmacFinal(&hmacContext, digest);

NSData *out = [NSData dataWithBytes:digest length:CC_SHA1_DIGEST_LENGTH]

Answer 1

I just spent like 4 hours Googling and looking for ways to calculate an unkeyed SHA1 on the iPhone that would match the results of the sha1() function in php. Here was the result:

    #import <CommonCrypto/CommonDigest.h>

    NSString *hashkey = <your data here>;
// PHP uses ASCII encoding, not UTF
const char *s = [hashkey cStringUsingEncoding:NSASCIIStringEncoding];
NSData *keyData = [NSData dataWithBytes:s length:strlen(s)];

// This is the destination
uint8_t digest[CC_SHA1_DIGEST_LENGTH] = {0};
// This one function does an unkeyed SHA1 hash of your hash data
CC_SHA1(keyData.bytes, keyData.length, digest);

// Now convert to NSData structure to make it usable again
NSData *out = [NSData dataWithBytes:digest length:CC_SHA1_DIGEST_LENGTH];
// description converts to hex but puts <> around it and spaces every 4 bytes
NSString *hash = [out description];
hash = [hash stringByReplacingOccurrencesOfString:@" " withString:@""];
hash = [hash stringByReplacingOccurrencesOfString:@"<" withString:@""];
hash = [hash stringByReplacingOccurrencesOfString:@">" withString:@""];
// hash is now a string with just the 40char hash value in it

Hopefully this will help others who are struggling with SHA1 on the iPhone

Answer 2

If you are calling the Amazon web service too look up prices or product details, your Amazon web service key will be disabled and your app will stop working.

Look at the terms of service of the Amazon Web Services, use by mobile clients is strictly disallowed:

https://affiliate-program.amazon.com/gp/advertising/api/detail/agreement.html

I found this out the hard way when my own application had my AWS key disabled in a production app. I had read the TOS, but it was not really there as you can see by the link above to some other obscure detail of use. You wouldn't think the affiliate program would have anything to do with the API, but it does.

You can find details of other apps blocked at this TechCrunch article:

http://www.techcrunch.com/2009/07/07/amazon-killing-mobile-apps-that-use-its-data/

Just giving you a heads up and hopefully saving you a lot of work.

Answer 3

// This is my code used in my Twitter connection, and working well for me.
// KeithF's code was a big help!
//
// This is a category added to NSData.

@implementation NSData (EOUtil)
- (NSData*)dataByHmacSHA1EncryptingWithKey:(NSData*)key
{   
    void* buffer = malloc(CC_SHA1_DIGEST_LENGTH);
    CCHmac(kCCHmacAlgSHA1, [key bytes], [key length], [self bytes], [self length], buffer);
    return [NSData dataWithBytesNoCopy:buffer length:CC_SHA1_DIGEST_LENGTH freeWhenDone:YES];
}
@end

Answer 4

Take a look at CocoaCryptoHashing for the SHA1 encoding

Answer 5

I posted one solution to this here, that returns the Base64 encoded data that AWS requests.

Answer 6

Apple's iOS developer library has provided an excellent sample titled CryptoExercise which includes a simple function:

- (NSData *)getHashBytes:(NSData *)plainText" to get a SHA-1 hash.

Answer 7

You can see this maybe it helps you.