Yubico Forum

...visit our web-store at store.yubico.com
It is currently Tue Jan 30, 2018 12:13 pm

View unanswered posts | View active topics


Board index » Yubico » Community Projects

All times are UTC + 1 hour




Post new topic Reply to topic  Page 1 of 1
  [ 3 posts ] 
  Print view Previous topic | Next topic 
Author Message
gorkab
PostPosted: Mon Jul 07, 2008 7:26 pm 
Offline

Joined: Sat Jul 05, 2008 9:21 pm
Posts: 10
I'm trying to add HMAC verification in to the simple perl client. While I think i have it right, I can't seem to generate a response that matches the h= part from the Yubico servers.

I've taken the sample code, and added a few bits:

Code:
use Digest::SHA qw(hmac_sha1);
use MIME::Base64;

my $MyYubicoAPIKey = "myAPIkey";
.
. snip
.
my $YubicoAuthString = "&id=". $ARGV[0] . "&otp=" . $ARGV[1];
my $YubicoAuthSrvURL = YubicoAuthSrvURLprefix . $YubicoAuthString;

my $mech = WWW::Mechanize->new();
$mech->get($YubicoAuthSrvURL);
my $YubicoAuthSrvResponse = $mech->response()->content();

if ($YubicoAuthSrvResponse =~ /status=OK/) {
  print "\nOTP verification ok\n";
  print "$YubicoAuthSrvResponse";
  print "v=" . encode_base64(hmac_sha1($YubicoAuthString, $MyYubicoAPIKey));
} else {
  print "\nOTP verification failed\n";
  print "$YubicoAuthSrvResponse";
  print "v=" . encode_base64(hmac_sha1($YubicoAuthString, $MyYubicoAPIKey));
}


when i run it, it doesn't generate the proper verification (v=):
(mID is my numeric ID from Yubico when i generated an API key)

Code:
perl YubicoAuthClient.pl myID fghbibnivrtkrvdetdhcrfrklgcrkrkrvrchiriitdkt

OTP verification ok
h=di+/stO00nh4oDaqA+7sJ24TI0Y=
t=2008-07-09T02:33:19Z0762
status=OK

v=JsUPm4RnBwwOIDodGYEf2MDYFFI=


i guess my question is, am i passing the right info to the hash and base64 functions? am i missing something here?


Last edited by gorkab on Tue Jul 08, 2008 3:00 pm, edited 1 time in total.

Top
 Profile  
Reply with quote  

Share On:
Share on Facebook FacebookShare on Twitter TwitterShare on Tumblr TumblrShare on Google+ Google+

gorkab
PostPosted: Tue Jul 08, 2008 2:59 pm 
Offline

Joined: Sat Jul 05, 2008 9:21 pm
Posts: 10
and the answer is... I'm missing something, and the API documentation is very unclear. I've got it working now thanks to the work of the PHP team. (the api documentation i am referring to is here http://www.yubico.com/developers/intro/ , if there are better docs elsewhere I didn't find them)

End problems in a nutshell were:

1) the API key is base64 encoded when given to you, but you need to operate with it in non-base64 format. this is not in the API documentation on the web page that I could find.

2) what you are actually hashing on the return is not clear from the API documentation. i've figured it out (again thanks to the PHP folks here), but the API documentation was again very unclear.

My only remaining problem is that when there is a + symbol in the outgoing HMAC it returns a bad signature. I've seen people allude to URL encoding that string, but the perl url_escape functions
seem to still end up with a bad signature return. I'm working on this. Once it's done, I will publish updated code here.
Top
 Profile  
Reply with quote  
gorkab
PostPosted: Tue Jul 08, 2008 9:17 pm 
Offline

Joined: Sat Jul 05, 2008 9:21 pm
Posts: 10
working code -

Code:
#!/usr/bin/perl

# {{{ Includes

use strict;
use warnings;

use Digest::SHA qw(hmac_sha1);
use File::Basename;
use MIME::Base64;
use URI::Escape;
use WWW::Mechanize;

# }}}
# {{{ Constants

use constant YUBICOAUTHSRVURLPREFIX => 'http://api.yubico.com/wsapi/verify?';
use constant MYYUBICOAPIKEY         => '';

# }}}
# {{{ Globals

my $MyDecodedYubicoAPIKey = decode_base64(MYYUBICOAPIKEY);

# }}}
# {{{ usage()

sub usage(;$) {
    print "\n\n!!!  @_\n\n" if @_;
    my $prog = basename $0;

    print <<_USAGE_END;

Usage:
    $prog  clientID  oneTimePasscode

_USAGE_END
}

# }}}
# {{{ main

if ( @ARGV != 2 ) {
    usage and exit 2;
}

my $YubicoAuthString = "id=" . $ARGV[0] . "&otp=" . $ARGV[1];

my $YubicoAuthHash = "&h="
    . uri_escape(
    encode_base64( hmac_sha1( $YubicoAuthString, $MyDecodedYubicoAPIKey ) ),
    '+' );

my $YubicoAuthSrvURL
    = YUBICOAUTHSRVURLPREFIX . $YubicoAuthString . $YubicoAuthHash;

print "\nAuth Request = $YubicoAuthSrvURL\n";

my $mech = WWW::Mechanize->new();

$mech->get($YubicoAuthSrvURL);

my $YubicoAuthSrvResponse = $mech->response()->content();

my ( $YubiHMAC, $YubiTime, $YubiStat )
    = split( /\n/, $YubicoAuthSrvResponse );

chop( $YubiHMAC, $YubiTime, $YubiStat );

my $YubiCheckString = $YubiStat . "&" . $YubiTime;

my $YubiCheckHash = "h="
    . encode_base64( hmac_sha1( $YubiCheckString, $MyDecodedYubicoAPIKey ) );

chomp($YubiCheckHash);

if ( $YubiStat =~ /status=OK/ ) {
    print " OTP verification ok\n";
}
else {
    print " OTP verification failed\n";
}

if ( $YubiCheckHash eq $YubiHMAC ) {
    print "HMAC verification ok\n";
}
else {
    print "HMAC verification failed\n";
}

print "\n";
print "VMAC = $YubiCheckHash\n";
print "HMAC = $YubiHMAC\n";
print "TIME = $YubiTime\n";
print "STAT = $YubiStat\n\n";

# }}}
Top
 Profile  
Reply with quote  
Display posts from previous:  Sort by  
Post new topic Reply to topic  Page 1 of 1
  [ 3 posts ] 

Board index » Yubico » Community Projects

All times are UTC + 1 hour


Who is online

Users browsing this forum: No registered users and 2 guests

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB® Forum Software © phpBB Group