Re: HMAC (SHA1) key longer than 81 characters not possible?

Hi,

yes, we can :-). Let say that SAP implementation supports a key with size more than 81 bytes. Then according to specification if the key is longer than block size of hash function (64 bytes for SHA-1) then it would use hash function to reduce original key to new key with size equals to output size of hash function (20 bytes for SHA-1). Therefore doing this step manually before calling SET_HMAC_KEY is equal to calling SET_HMAC_KEY which supports keys longer than 81 bytes.

The easiest way how to check this is to compare some HMAC-SHA1 implementation with the result produced by my proposed logic.

DATA: text TYPE string,        key_str TYPE string,        hash TYPE hash160x,        key TYPE xstring,        hmac TYPE hash512_base_64.  text = 'Hello'.  key_str = '012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789'.  CALL FUNCTION 'CALCULATE_HASH_FOR_CHAR'    EXPORTING      data  = key_str    IMPORTING      hashx = hash.  key = hash.  CALL FUNCTION 'SET_HMAC_KEY'    EXPORTING      generate_random_key = space      alg                 = 'SHA1'      keyxstr             = key      client_independent  = space.  CALL FUNCTION 'CALCULATE_HMAC_FOR_CHAR'    EXPORTING      alg        = 'SHA1'      data       = text    IMPORTING      hmacbase64 = hmac.  WRITE: / hmac.

Javascript version

var hmac = Crypto.HMAC(Crypto.SHA1, "Message", "Secret Passphrase");

var hmacBytes = Crypto.HMAC(Crypto.SHA1, "Message", "Secret Passphrase", { asBytes: true });
var hmacString = Crypto.HMAC(Crypto.SHA1, "Message", "Secret Passphrase", { asString: true });

Both implementations return "qsXNz/wecK4PMob6VG9RyRX6DQI=".

Cheers

Sorry for formatting but it looks like something is broken.

Edited by: Martin Voros on Aug 6, 2010 10:34 PM