Yubico Forum

Re: hmac verification in perl (RESOLVED)

2008-07-08T21:17:44+01:00

working code -

Code:

#!/usr/bin/perl

# {{{ Includes

use strict;
use warnings;

use Digest::SHA qw(hmac_sha1);
use File::Basename;
use MIME::Base64;
use URI::Escape;
use WWW::Mechanize;

# }}}
# {{{ Constants

use constant YUBICOAUTHSRVURLPREFIX => 'http://api.yubico.com/wsapi/verify?';
use constant MYYUBICOAPIKEY         => '';

# }}}
# {{{ Globals

my $MyDecodedYubicoAPIKey = decode_base64(MYYUBICOAPIKEY);

# }}}
# {{{ usage()

sub usage(;$) {
    print "\n\n!!!  @_\n\n" if @_;
    my $prog = basename $0;

    print <<_USAGE_END;

Usage:
    $prog  clientID  oneTimePasscode

_USAGE_END
}

# }}}
# {{{ main

if ( @ARGV != 2 ) {
    usage and exit 2;
}

my $YubicoAuthString = "id=" . $ARGV[0] . "&otp=" . $ARGV[1];

my $YubicoAuthHash = "&h="
    . uri_escape(
    encode_base64( hmac_sha1( $YubicoAuthString, $MyDecodedYubicoAPIKey ) ),
    '+' );

my $YubicoAuthSrvURL
    = YUBICOAUTHSRVURLPREFIX . $YubicoAuthString . $YubicoAuthHash;

print "\nAuth Request = $YubicoAuthSrvURL\n";

my $mech = WWW::Mechanize->new();

$mech->get($YubicoAuthSrvURL);

my $YubicoAuthSrvResponse = $mech->response()->content();

my ( $YubiHMAC, $YubiTime, $YubiStat )
    = split( /\n/, $YubicoAuthSrvResponse );

chop( $YubiHMAC, $YubiTime, $YubiStat );

my $YubiCheckString = $YubiStat . "&" . $YubiTime;

my $YubiCheckHash = "h="
    . encode_base64( hmac_sha1( $YubiCheckString, $MyDecodedYubicoAPIKey ) );

chomp($YubiCheckHash);

if ( $YubiStat =~ /status=OK/ ) {
    print " OTP verification ok\n";
}
else {
    print " OTP verification failed\n";
}

if ( $YubiCheckHash eq $YubiHMAC ) {
    print "HMAC verification ok\n";
}
else {
    print "HMAC verification failed\n";
}

print "\n";
print "VMAC = $YubiCheckHash\n";
print "HMAC = $YubiHMAC\n";
print "TIME = $YubiTime\n";
print "STAT = $YubiStat\n\n";

# }}}

Statistics: Posted by gorkab — Tue Jul 08, 2008 9:17 pm

Re: hmac verification in perl

2008-07-08T14:59:45+01:00

and the answer is... I'm missing something, and the API documentation is very unclear. I've got it working now thanks to the work of the PHP team. (the api documentation i am referring to is here http://www.yubico.com/developers/intro/ , if there are better docs elsewhere I didn't find them)

End problems in a nutshell were:

1) the API key is base64 encoded when given to you, but you need to operate with it in non-base64 format. this is not in the API documentation on the web page that I could find.

2) what you are actually hashing on the return is not clear from the API documentation. i've figured it out (again thanks to the PHP folks here), but the API documentation was again very unclear.

My only remaining problem is that when there is a + symbol in the outgoing HMAC it returns a bad signature. I've seen people allude to URL encoding that string, but the perl url_escape functions
seem to still end up with a bad signature return. I'm working on this. Once it's done, I will publish updated code here.

Statistics: Posted by gorkab — Tue Jul 08, 2008 2:59 pm

hmac verification in perl (RESOLVED)

2008-07-08T15:00:35+01:00

I'm trying to add HMAC verification in to the simple perl client. While I think i have it right, I can't seem to generate a response that matches the h= part from the Yubico servers.

I've taken the sample code, and added a few bits:

Code:

use Digest::SHA qw(hmac_sha1);
use MIME::Base64;

my $MyYubicoAPIKey = "myAPIkey";
.
. snip
.
my $YubicoAuthString = "&id=". $ARGV[0] . "&otp=" . $ARGV[1];
my $YubicoAuthSrvURL = YubicoAuthSrvURLprefix . $YubicoAuthString;

my $mech = WWW::Mechanize->new();
$mech->get($YubicoAuthSrvURL);
my $YubicoAuthSrvResponse = $mech->response()->content();

if ($YubicoAuthSrvResponse =~ /status=OK/) {
  print "\nOTP verification ok\n";
  print "$YubicoAuthSrvResponse";
  print "v=" . encode_base64(hmac_sha1($YubicoAuthString, $MyYubicoAPIKey));
} else {
  print "\nOTP verification failed\n";
  print "$YubicoAuthSrvResponse";
  print "v=" . encode_base64(hmac_sha1($YubicoAuthString, $MyYubicoAPIKey));
}

when i run it, it doesn't generate the proper verification (v=):
(mID is my numeric ID from Yubico when i generated an API key)

Code:

perl YubicoAuthClient.pl myID fghbibnivrtkrvdetdhcrfrklgcrkrkrvrchiriitdkt

OTP verification ok
h=di+/stO00nh4oDaqA+7sJ24TI0Y=
t=2008-07-09T02:33:19Z0762
status=OK

v=JsUPm4RnBwwOIDodGYEf2MDYFFI=

i guess my question is, am i passing the right info to the hash and base64 functions? am i missing something here?

Statistics: Posted by gorkab — Mon Jul 07, 2008 7:26 pm