SHA384 online Hash Generator

I am trying to write client code that requests for information from an external API over the web.

The API is simple enough (to me) except for the stipulations of how to generate the authorisation key.First some context:There are 6 string values required to start with:

• token
• password
• devId
• salt
• orgId
• givenKey

Now for the encryption stuff. First up SHA2.

hashedString = SHA2(token + password + devId)

Followed by AES.

authKey = AES(salt + orgId + "=" + hashedString)

The AES parameters are specified as follows:

• Mode = ECB
• Padding = PKCS5Padding
• Secret Key = givenKey

My problem is that I know next to nothing about cryptography.

Below is the code I have attempting to accomplish the above.

// Generate Authorisation key            byte[] fieldsBytes = Encoding.ASCII.GetBytes(token + password + devId);            byte[] keyBytes = Encoding.ASCII.GetBytes(secretKey);            SHA512 shaM = new SHA512Managed();            string hashedFields = Encoding.ASCII.GetString(shaM.ComputeHash(fieldsBytes));            byte[] encryptedBytes = EncryptStringToBytes_Aes(salt + orgId + "=" + hashedfields,                keyBytes, keyBytes);            string encryptedString = Encoding.ASCII.GetString(encryptedBytes);private byte[] EncryptStringToBytes_Aes(string plainText, byte[] Key, byte[] IV)        {            // Check arguments.            if (plainText == null || plainText.Length <= 0)                throw new ArgumentNullException("plainText");            if (Key == null || Key.Length <= 0)                throw new ArgumentNullException("Key");            if (IV == null || IV.Length <= 0)                throw new ArgumentNullException("IV");            byte[] encrypted;            // Create an Aes object            // with the specified key and IV.            using (Aes aesAlg = Aes.Create())            {                aesAlg.Key = Key;                aesAlg.IV = IV;                aesAlg.Padding = PaddingMode.PKCS7;                aesAlg.Mode = CipherMode.ECB;                // Create an encryptor to perform the stream transform.                ICryptoTransform encryptor = aesAlg.CreateEncryptor();                // Create the streams used for encryption.                using (MemoryStream msEncrypt = new MemoryStream())                {                    using (CryptoStream csEncrypt = new CryptoStream(msEncrypt, encryptor, CryptoStreamMode.Write))                    {                        using (StreamWriter swEncrypt = new StreamWriter(csEncrypt))                        {                            //Write all data to the stream.                            swEncrypt.Write(plainText);                        }                        encrypted = msEncrypt.ToArray();                    }                }            }            // Return the encrypted bytes from the memory stream.            return encrypted;        }

This code gets a "401" from the external service.

My first issue is that there does not seem to be a NET method named SHA2. The closest I could find is SHA512 and I am not sure if SHA512 is a .NET implementation of SHA2.

Secondly, padding for AES has been specified as PKCS5Padding but again the closest (naming-wise) I could find is PKCS7 which I am not sure about how similar it is to PKCS5.

There is also the matter of an Initialisation Vector (IV), which the AES parameters don't specify but I see C# AES examples including. In the code, I have set it to have the same value as the Key (which I believeis what the API calls "secret key") out of sheer desperation but I have tried making the request without setting IV to any value and still get back a 401.

I should probably also mention that I am using ASCII encoding to convert to-and-from bytes because I first tried using UTF8 but when it came to actually making the HTTP request, I was getting an exceptionsaying that header values (remember we are generating an authorisation key that will be tucked in a HTTP request header) should only be encoded in ASCII.

Any help pointing me in the right direction will be immensely appreciated as I am woefully out of my depth with this cryptography stuff.

I'm testing a piece of code that performs a hash operation (sha256) of a binary file and I've got something like this:

for(i = 0; i < SHA256_DIGEST_LENGTH; i++) printf("%02x", c[i]);

This prints something like:

12b64492d18aa37d609f27cb02ce5ba381068d1ef5625193df68451c650a2b8d

I'm asking how can I do to get the string shown below into a string variable in C++.

thanks

I'm writing a docker script and therefore I cannot rely on bash scripts. I need the docker script to fail if the sha256sum of a downloaded file (though wget) hash is incorrect. I see that there exists a check option in sha256sum, but I can't find how to use it.

It's something like sha256sum -c hash file but it won't work for me. I think I actually must supply a file to -c, something like using echo.

Note: this question was sort of asked here, but not answered.

I need to communicate securely between two Tomcat servers running in two different environments. I have control of both servers.

I would like to do this through a simple REST call from Server-B to Server-A.

On the server I am communicating to, Server-A, I can easily set up HTTPS with a self-signed certificate. If I import this certificate into the Java Keystore on Server-B, I can make a trusted HTTPS Rest call from my Java code on Server-B.

Good instructions for doing this can be found here:https://blog.10pines.com/2017/09/25/how-to-communicate-via-https-between-two-tomcat-servers-using-a-self-signed-certificate/

I would also like to add a confirmation that the Rest call to Server-A is certainly coming from Server-B and the message has integrity.

My plan is to generate a self-signed certificate on Server-B and import this certificate into the Java Keystore on Server-A. Then for any REST call from Server-B I will first generate an SHA-512 hash of the message and sign the hash with the private key associated with the Server-B certificate. When Server-A receives the message, the SHA-512 hash will be recalculated and checked for accuracy of the hash (no message tampering). I will then check the signature of the Hash against the public key of the certificate from Server-B.

For a little bit of extra paranoia I may encrypt the REST message with the public key of the certificate from Server-A; for short messages this should be fine (no need for Symmetric encryption).

Does this seem like a good plan? Does Tomcat have a simpler mechanism for doing this?

The Java Messaging API seems a little "heavy" for this use case.

exaple, string "test" in https://md5calc.com/hash/sha3-512/test gives me "9ece086e9bac491fac5c1d1046ca11d737b92a2b2ebd93f005d7b710110c0a678288166e7fbe796883a4f2e9b3ca9f484f521d0ce464345cc1aec96779149c14"

but

using HashLib; // from https://www.nuget.org/packages/HashLibusing System;class Program{    static void Main(string[] args)    {        var sha3512 = HashFactory.Crypto.SHA3.CreateKeccak512();        var tempHash = sha3512.ComputeString("test");        Console.WriteLine(tempHash.ToString().ToLower().Replace("-", ""));    }}

returns"3abff7b1f2042ac3861bd4c0b40efaa8a695909bfb31753fc7b1bd69778de1225a627c8f07cf4814cc05435ada2a1ffee3f4513a8867154274787624f24e551b"

i need to get first string, not that hashlib provides.