HMAC SHA1 using Java

18 January 2008 17:59 (EST)
Working with OpenID CFC project I found another way to create HMAC:SHA1 string using Java:

<cffunction name="HMAC_SHA1" returntype="binary" access="public" output="false">
   <cfargument name="signKey" type="string" required="true" />
   <cfargument name="signMessage" type="string" required="true" />

   <cfset var jMsg = JavaCast("string",arguments.signMessage).getBytes("iso-8859-1") />
   <cfset var jKey = JavaCast("string",arguments.signKey).getBytes("iso-8859-1") />

   <cfset var key = createObject("java","javax.crypto.spec.SecretKeySpec") />
   <cfset var mac = createObject("java","javax.crypto.Mac") />

   <cfset key = key.init(jKey,"HmacSHA1") />

   <cfset mac = mac.getInstance(key.getAlgorithm()) />
   <cfset mac.init(key) />
   <cfset mac.update(jMsg) />

   <cfreturn mac.doFinal() />

</cffunction>

So I am going to include this code to next release of the project.
Tags coldfusion openid hmac sha1 java

AddThis Social Bookmark Button

← OpenID 2.0 Final Validate your feed! →

Comments

Reena: 18 January 2008 20:47 (EST)

what is HMAC:SHA1.
(reply)
OpenIDwww.yakhnov.ru: 19 January 2008 02:18 (EST)

SHA stands for Secure Hash Algorithm. The SHA hash functions are five cryptographic hash functions designed by the National Security Agency (NSA) and published by the NIST as a U.S. Federal Information Processing Standard.

In cryptography, a keyed-Hash Message Authentication Code, or HMAC, is a type of message authentication code (MAC) calculated using a specific algorithm involving a cryptographic hash function in combination with a secret key.
(reply)
Gabriel: 5 March 2008 07:46 (EST)

This is fantastic!!!!
Using it for Google Checkout calculation. Thank you!!!!
(reply)
rednael: 20 November 01:15 (EST)

Good post,

Please also read the following article:
http://blog.rednael.com/2008/09/30/SecuringYourPasswordTransfersWithKeyedHashingHMACCramMD5.aspx

It's a walkthrough example of implementing HMAC-MD5 / Cram-MD5 on a website. The same technique can be used for various client-server situations.
The article explains the benefits of using such a password system and shows you how to implement it using the .Net library at server side (examples in C#), and using Paj’s MD5 Javascript functions at client-side.
(reply)
Jason: 12 May 07:48 (EST)

Thanks for this post! Do you know where I might find the equivalent code to decrypt the string? I have been trying to figure it out for a while, but cannot get it to work.
(reply)

Drop a comment... don't be shy