SHA1 Implementation avialable?

[jvdsandt]

Hello,

Does anybody know if VisualAge for Smalltalk contains an implementation of the SHA1 secure hash algorithm? I found the "internal" class SstShaEngine but this seems to be only a partial implementation.

Regards,
Jan van de Sandt.

[nchillo]

I am having the same problem.
I need to invoke a secure webservice (with SstWSUsernameToken) and need to encript the password using SHA1.

If you have any answer or find an alternative solution please let me know.
Thanks,
Nicolas

[wembley]

Jan and Nicolas -

What functionality that you need is missing from SstShaEngine?

[nchillo]

I think my problem is I am not understanding how to use the SstSHAEngine.
Could you please post an example.
Thanks.

[jkoepp]

Here are two wikipedia examples (http://en.wikipedia.org/wiki/SHA_hash_functions)
(SstShaEngine new digest: 'The quick brown fox jumps over the lazy dog' asByteArray) asByteArray abtMD5AsHexString

returns '2FD4E1C67A2D28FCED849EE1BB76E7391B93EB12'

(SstShaEngine new digest: 'The quick brown fox jumps over the lazy cog' asByteArray) asByteArray abtMD5AsHexString

returns 'DE9F2C7FD25E1B3AFAD3E85A0BD17D9B100DB4B3'

[jvdsandt]

Hello all,

I need the SHA1 implementation because I want to use the SimpleDB service from Amazon. You need to sign your requests to this service using SHA1 and HMAC, so I also need support for HMAC. See http://docs.amazonwebservices.com/Amazo ... ation.html

Somebody gave me a tip and told me that VAST uses the OpenSSL library. This library supports the functions I am looking for. The functions are not yet available through the Smalltalk wrapper in the SciSslOpenSSLInterface. So now I am trying to add this function to the Smalltalk wrapper class.

I have added the following line to SciSslOpenSSLInterface>>_PRAGMA_SciSslFunctions
(name: HMAC isConstant: true valueExpression: 'PlatformFunction fromArray: #(''C'' ''HMAC'' nil ''CRYPTO_LIB'' #(#pointer #pointer #int32 #pointer #int32 #pointer #pointer) #pointer)')

To wrap the C function (from http://www.openssl.org/docs/crypto/hmac.html):
unsigned char *HMAC(const EVP_MD *evp_md, const void *key,
int key_len, const unsigned char *d, int n,
unsigned char *md, unsigned int *md_len);

In the first argument I need to specify that SHA1 should be used as the hash function.

I haven't figured out yet how to set up the arguments correctly. I will need some advice from someone with experience integrating C libaries in VAST. When I have it working I will post the results here.

[jvdsandt]

Hello all,

I figured out how to get the SHA1-HMAC functionality to work using the OpenSSL libraries. The script below shows how it works:

Code: Select all

| sha1Func hmacFunc key message digest digestLen |
sha1Func := PlatformFunction fromArray: #('C' 'EVP_sha1' nil 'CRYPTO_LIB' #() #pointer).
hmacFunc := PlatformFunction fromArray: #('C' 'HMAC' nil 'CRYPTO_LIB' #(#pointer #pointer #int32 #pointer #int32 #pointer #pointer) #pointer).
key := 'our-secret' asByteArray.
message := 'Smalltalk is Cool!' asByteArray.
digest := ByteArray new: 20.
digestLen := ByteArray new: 4.
hmacFunc callWith: sha1Func call
   with: key
   with: key size
   with: message
   with: message size
   with: digest
   with: digestLen.
digest

The CRYPTO_LIB constant is defined in the SciSslOpenSSLInterface application, so this application is required as a prerequisite.

Jan.

[Thomas Holzer]

Jan and Nicolas -

What functionality that you need is missing from SstShaEngine?

Hello John,

I think, the SstShaEngine class should be in an own application. Like the AbtMD5Engine is. Because if someone wants to use only the SHA features without SST, he is forced to use all the SST RMI classes, which are not needed.

Regards Thomas

[marten]

Jan and Nicolas -

What functionality that you need is missing from SstShaEngine?

Hello John,

I think, the SstShaEngine class should be in an own application. Like the AbtMD5Engine is. Because if someone wants to use only the SHA features without SST, he is forced to use all the SST RMI classes, which are not needed.

Regards Thomas

Ok, but the only problem is, that one has to load all stuff, which is not actually needed - but on the other hand the packager should throw all unneeded classes away. I have a similiar problem: a class I really like is SstSharedQueue - even without using the whole SST framework.

Marten