I have the following code in C#

var apiKey = "SBB3aWxsIG1ha2UgbXbcQVBJIHN|Y3VyZQ==";
var apiSecret = "QaTW3xlf1U5ljdlAJSdltzT71fFF+eZ=";

var key = Convert.FromBase64String(apiSecret);
var provider = new System.Security.Cryptography.HMACSHA256(key);

var hash = provider.ComputeHash(Encoding.UTF8.GetBytes(apiKey));
var signature = Convert.ToBase64String(hash);

I am trying to get the same result in Javascript using the CryptJS library but from what i can tell i am not converting the key and secret to byte arrays and the encoding is incorrect. first try looks like:

var apiKey = "SBB3aWxsIG1ha2UgbXbcQVBJIHN|Y3VyZQ==";
var apiSecret = "QaTW3xlf1U5ljdlAJSdltzT71fFF+eZ=";
var hash = CryptoJS.HmacSHA256(apiKey, apiSecret);
var sig = hash.toString(CryptoJS.enc.Base64);

I have the following code in C#

var apiKey = "SBB3aWxsIG1ha2UgbXbcQVBJIHN|Y3VyZQ==";
var apiSecret = "QaTW3xlf1U5ljdlAJSdltzT71fFF+eZ=";

var key = Convert.FromBase64String(apiSecret);
var provider = new System.Security.Cryptography.HMACSHA256(key);

var hash = provider.ComputeHash(Encoding.UTF8.GetBytes(apiKey));
var signature = Convert.ToBase64String(hash);

I am trying to get the same result in Javascript using the CryptJS library but from what i can tell i am not converting the key and secret to byte arrays and the encoding is incorrect. first try looks like:

var apiKey = "SBB3aWxsIG1ha2UgbXbcQVBJIHN|Y3VyZQ==";
var apiSecret = "QaTW3xlf1U5ljdlAJSdltzT71fFF+eZ=";
var hash = CryptoJS.HmacSHA256(apiKey, apiSecret);
var sig = hash.toString(CryptoJS.enc.Base64);

• javascript
• c#
• hash
• sha256
• cryptojs

• 2 Read the code that you've posted here again. You forgot to parse the Base64-encoded apiSecret in CryptoJS. Even worse, you forgot to pass apiKey and apiSecret to CryptoJS.HmacSHA256 entirely. – Artjom B. Commented Aug 12, 2016 at 22:27
• It was a quick cut and paste of the original code from the CryptoJS docs. Passing the correct values still doesn't fix it but thanks for pointing that out. Do you have any actual insight into making it work? – billy jean Commented Aug 13, 2016 at 15:17
• 1 Yes, I have actual insight which I already shared with you. You already should have the tools to make it work. Do you have trouble parsing the Base64-encoded string with CryptoJS? If not, have you exchanged the order of the arguments to CryptoJS.HmacSHA256? – Artjom B. Commented Aug 13, 2016 at 15:38
• Why not add the answer then i can mark it as accepted and other people can benefit from the correct answer? I appreciate your help.. just not following your response. – billy jean Commented Aug 13, 2016 at 16:47
• Currently, you're passing the literal string "apiKey" rather than the variable apiKey to the HmacSHA256 function. – Heretic Monkey Commented Aug 16, 2016 at 18:42

1 Answer 1

Inspire by https://stackoverflow.com/a/13837543/1810391

Javascript

var CryptoJS = require('crypto-js');

var apiKey = "SBB3aWxsIG1ha2UgbXbcQVBJIHN|Y3VyZQ==";
var apiSecret = "QaTW3xlf1U5ljdlAJSdltzT71fFF+eZ=";

// var key = Convert.FromBase64String(apiSecret);
var key = CryptoJS.enc.Base64.parse(apiSecret);
console.log('key:' + key);

// var prehash = Encoding.UTF8.GetBytes(apiKey);
var prehash = CryptoJS.enc.Utf8.parse(apiKey);
console.log('Pre-hash:' + prehash);

// var provider = new System.Security.Cryptography.HMACSHA256(key);
// var hash = provider.ComputeHash(prehash);
var hash = CryptoJS.HmacSHA256(prehash, key);
console.log('hash:' + hash);

//var signature = Convert.ToBase64String(hash);
var signature = hash.toString(CryptoJS.enc.Base64);
console.log('signature:' + signature);

Javascript Output

key:41a4d6df195fd54e658dd940252765b734fbd5f145f9e6
Pre-hash:53424233615778734947316861325567625862635156424a49484e7c593356795a513d3d
hash:ecb6cdf5dd39872bb2cbce4321e2725e11b99c01af9c2a620ebbaf3d8d8607e7
signature:7LbN9d05hyuyy85DIeJyXhG5nAGvnCpiDruvPY2GB+c= 

C#

using System;
using System.Text;

namespace ConsoleApplication
{
    public class Program
    {
        public static void Main(string[] args)
        {
            var apiKey = "SBB3aWxsIG1ha2UgbXbcQVBJIHN|Y3VyZQ==";
            var apiSecret = "QaTW3xlf1U5ljdlAJSdltzT71fFF+eZ=";
            var key = Convert.FromBase64String(apiSecret);
            Console.Write("key:");
            prtByte(key);

            Console.Write("Pre-hash:");
            prtByte(Encoding.UTF8.GetBytes(apiKey));
            var provider = new System.Security.Cryptography.HMACSHA256(key);
            var hash = provider.ComputeHash(Encoding.UTF8.GetBytes(apiKey));
            Console.Write("hash:");
            prtByte(hash);

            var signature = Convert.ToBase64String(hash);
            Console.WriteLine("signature:" + signature);
        }
        public static void prtByte(byte[] b)
        {
            for (var i = 0; i < b.Length; i++)
            {
                Console.Write(b[i].ToString("x2"));
            }
            Console.WriteLine();
        }
    }
}

C# Output

key:41a4d6df195fd54e658dd940252765b734fbd5f145f9e6
Pre-hash:53424233615778734947316861325567625862635156424a49484e7c593356795a513d3d
hash:ecb6cdf5dd39872bb2cbce4321e2725e11b99c01af9c2a620ebbaf3d8d8607e7
signature:7LbN9d05hyuyy85DIeJyXhG5nAGvnCpiDruvPY2GB+c=