Implementing SHA1-HMAC with Python

Question

I am implementing SHA1-HMAC generation for python (v 3.7) to be able to create HMAC code.

I have used an online generator to create SHA1-HMAC with the following data:

string: '123'
Secret Key: 'secret'
Digest algorithm: SHA1

I am getting this result:

b14e92eb17f6b78ec5a205ee0e1ab220fb7f86d7

However when I try to do this same with Python I am getting different results which are wrong.

import hashlib
import hmac
import base64

def make_digest(message, key):
    key = bytes(key, 'UTF-8')
    message = bytes(message, 'UTF-8')

    digester = hmac.new(key, message, hashlib.sha1)
    signature1 = digester.digest()

    signature2 = base64.urlsafe_b64encode(signature1)    
    return str(signature2, 'UTF-8')


result = make_digest('123', 'secret')
print(result)

This code gives result:

sU6S6xf2t47FogXuDhqyIPt_htc=

What could be wrong with this code?

Martijn Pieters · Accepted Answer · 2018-09-26 13:41:34Z

9

You should not use Base64 here. The site you link to gives you the hex values of the digest bytes. Use the HMAC.hexdigest() method to get the same value in hex in Python:

>>> key = b'secret'
>>> message = b'123'
>>> digester = hmac.new(key, message, hashlib.sha1)
>>> digester.hexdigest()
'b14e92eb17f6b78ec5a205ee0e1ab220fb7f86d7'

put differently, your code outputs the correct value, but as Base64-encoded data:

>>> digester.digest()
b'\xb1N\x92\xeb\x17\xf6\xb7\x8e\xc5\xa2\x05\xee\x0e\x1a\xb2 \xfb\x7f\x86\xd7'
>>> base64.urlsafe_b64encode(digester.digest())
b'sU6S6xf2t47FogXuDhqyIPt_htc='

and the value you generated online contains the exact same bytes as the hex digest, so we can generate the same base64 output for that:

>>> bytes.fromhex('b14e92eb17f6b78ec5a205ee0e1ab220fb7f86d7')
b'\xb1N\x92\xeb\x17\xf6\xb7\x8e\xc5\xa2\x05\xee\x0e\x1a\xb2 \xfb\x7f\x86\xd7'
>>> base64.urlsafe_b64encode(bytes.fromhex('b14e92eb17f6b78ec5a205ee0e1ab220fb7f86d7'))
b'sU6S6xf2t47FogXuDhqyIPt_htc='

edited Sep 26, 2018 at 13:41

answered Sep 26, 2018 at 13:32

Martijn Pieters

1.1m326 gold badges4.2k silver badges3.4k bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

kaaleppi3 Over a year ago

Thank you for explanation. It was really helpful.

Collectives™ on Stack Overflow

Implementing SHA1-HMAC with Python

1 Answer 1

1 Comment

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Linked

Related