Base64 HMAC SHA1 String in VBA

Question

I'm trying to convert an ASP/VBScript OAuth library to VBA. One of the challenges is this line of code:

Get_Signature = b64_hmac_sha1(strSecret, strBaseSignature)

This function, b64_hmac_sha1 is actually a function contained in a JavaScript library. It appears to me that calling a JavaScript function from VBA is fairly impractical.

Because I know so little about encryption, it's not even clear to me what this b64_hmac_sha1 function does. Is HMAC SHA1 different from SHA1?

I half suspect I might be able to find some VBA code online to do what I need to do if I just understood what this function is actually doing. If I do not find an existing function, I could possibly write one that would use the .NET Cryptography library (you can actually call the .NET cryptography libraries from VBA if you know how).

I'm not looking for someone to convert this JavaScript to VBA. I'm only trying to understand what it is that this b64_hmac_sha1 function is outputting so I can try to find ways to achieve the same output in VBA if possible.

A copy of this JavaScript library is visible on this website. You'll have to scroll down past the VBScript to the JavaScript section. http://solstice.washington.edu/solstice/ASP_Signing_REST_Example

Edit1:
OK, so here's the functions I ended up writing and using:

Public Function Base64_HMACSHA1(ByVal sTextToHash As String, ByVal sSharedSecretKey As String)

    Dim asc As Object, enc As Object
    Dim TextToHash() As Byte
    Dim SharedSecretKey() As Byte
    Set asc = CreateObject("System.Text.UTF8Encoding")
    Set enc = CreateObject("System.Security.Cryptography.HMACSHA1")

    TextToHash = asc.Getbytes_4(sTextToHash)
    SharedSecretKey = asc.Getbytes_4(sSharedSecretKey)
    enc.Key = SharedSecretKey

    Dim bytes() As Byte
    bytes = enc.ComputeHash_2((TextToHash))
    Base64_HMACSHA1 = EncodeBase64(bytes)
    Set asc = Nothing
    Set enc = Nothing

End Function

Private Function EncodeBase64(ByRef arrData() As Byte) As String

    Dim objXML As MSXML2.DOMDocument
    Dim objNode As MSXML2.IXMLDOMElement

    Set objXML = New MSXML2.DOMDocument

    ' byte array to base64
    Set objNode = objXML.createElement("b64")
    objNode.DataType = "bin.base64"
    objNode.nodeTypedValue = arrData
    EncodeBase64 = objNode.Text

    Set objNode = Nothing
    Set objXML = Nothing

End Function

Using this function:

Debug.Print Base64_HMACSHA1("abc", "123")
VAsMU9SSWDe9krP3Gr56nXC2dsQ=

Epicycle

I want to add that this function is necessary for OAuth 1.0 but is not necessary for OAuth 2.0. – Epicycle

Answer 1

HMAC is a construct for turning a hash function, like SHA1, into a Message Authentication Code (MAC).

Normal hash functions don't have any secret data associated with it. This means that anyone can compute the digest, assuming they have the original input. HMAC uses a secret key, so that only those in possession of the key can compute outputs.

Suppose I have a file, file.txt. I want to send this to you, and we need to make sure nobody tampers with it. Sorry, I have no clever way to represent this with just text.

me -> file.txt -> you
me -> SHA1(file.txt) -> you

Then you verify the result by computing your own SHA1 digest, and verifying it matches what I sent you.

Now suppose an attacker was in the middle. Unfortunately, because there is no secret involved, the attacker can modify the file, and compute his own file/digest pair. When you compute your version, it'll match what he sent you, and you'll be none the wiser.

me -> file.txt -> attacker -> modified.txt -> you
me -> SHA1(file.txt) -> attacker -> SHA1(modified.txt) -> you

With HMAC, we add a secret key to the computation.

me -> file.txt -> you
me -> SHA1_HMAC(file.txt, our_secret) -> you

When you compute your version, you apply the secret key as well, and the result matches. The attacker, without knowledge of the key, can't replace the digest.

me -> file.txt -> attacker -> modified.txt -> you 
me -> SHA1(file.txt) -> attacker -> SHA1_HMAC(modified.txt, // DOESN'T KNOW KEY) -> you

HMAC is a very specific way of adding the secret key. Unfortunately, simple methods of just concatenating a key to the end of the file, or pre-pending it before hashing, are vulnerable to different attacks (length extension attacks, for example).

The B64 is Base64 encoding the output, to make it pretty.

What this code is ultimately doing is taking some input, and some secret key, and computing a 160-bit digest, and base64 encoding the result.

There is an implementation of SHA1 HMAC in .NET

This looks like an implementation of Base64 for VBA

I hope this answers it well enough, or clear enough. If the text is confusing, please let me know. I tried a couple routes of how to express it, and none of them seemed that clear.

Fieldwork

Thanks for your help. I wrote my functions and posted them in my question under "Edit1". – Epicycle

Glad it helped. Is everything working? The order looks correct, as best I can tell, though I've never written VB or VBA. – Fieldwork

I guess I don't know for sure if it's working correctly or not. I'll post an example. – Epicycle

Answer 2

You have written:

It appears to me that calling a JavaScript function from VBA is fairly impractical.

That is a misjudgment.

Javascript can be easily packaged as a Windows Script Component (WSC) and then invokved via COM, from VBA, Perl, VB6, or what-have-you.

Here's an example of packaging Javascript as a WSC and invoking it: https://mcmap.net/q/130657/-how-can-i-use-javascript-within-an-excel-macro

Therefore, your problem should be easily solvable.

Overtly

I had actually ran across this option. I guess I'm not crazy over calling an outside COM server unless I absolutely have to. – Epicycle