Hash values not matching (possibly encoding-related?)

Question

Hi folks,

I'm sending a value from my front-end (Flex) to the back end (Oracle) along with a hash on the value.

From my front-end, I'm using the as3corelib library from Google Code to compute a HMAC hash value using the SHA1 algorithm:

com.adobe.crypto.HMAC.hash(mySecret, myMessage, com.adobe.crypto.SHA1);

At the back-end, I'm using Oracle's DBMS_CRYPTO package:

    dbms_crypto.mac(utl_raw.cast_to_raw(myMessage), dbms_crypto.hmac_sh1, 
utl_raw.cast_to_raw(mySecret));

These two values usually match. But I ran into one instance where they did not. I checked what was different and found that the front end was somehow adding the funky  character to the end of the message (it can't be seen in the back end data).

I'm guessing that it is somehow encoding related. Here's the source of the adobe function:

        public static function hash( secret:String, 
message:String, algorithm:Object = null ):String
        {
            var text:ByteArray = new ByteArray();
            var k_secret:ByteArray = new ByteArray();

            text.writeUTFBytes(message);
            k_secret.writeUTFBytes(secret);

            return hashBytes(k_secret, text, algorithm);
        }

I don't know how to check Oracle's hash as the body is encrypted.

So, any ideas why my hash values are not matching for this  character? (I know that the data shouldn't even have the additional  character which may be a line-break or something else, but regardless of the data I'm receiving, my hashing must work or it is unreliable). I suspect it's encoding-related, but I've no idea what I can do different.

Please help, friends.

EDIT: My database uses AL32UTF8. I'm not sure what encoding the Flex front end uses. The hash function in the package in the Flex front end appears like it expects UTF-encoded text but does that mean it's actually UTF? Does it depend on the oracle httpservice that serves the data to the front end?

Answer 1

Possibly you have a problem with the string encoding. In the front-end, you explicitly convert the strings into a UTF-8 byte representation. On the back-end, it depends on different session and database settings, which cannot be derived from your question.

So possibly the solution is:

dbms_crypto.mac(
  utl_raw.convert(utl_raw.cast_to_raw(myMessage), 'WE8ISO8859P1', 'UTF8'),
  dbms_crypto.hmac_sh1, 
  utl_raw.cast_to_raw(mySecret)
);

Instead of WE8ISO8859P1, use whatever your database or session setting regarding the character set is.

Answer 2

Finally resolved. The nls lang setting was different on the Oracle Application Server and the database storing the data.

Thanks to Codo for leading me in the right direction.