iPhone and HMAC-SHA-1 encoding

Question

im trying to get a call to amazon web service and im stuck on getting the signature, looked at this but i still have a question on it.

using this example what is the

NSData *keyData;
NSData *clearTextData

? what do i need to pass for these two values?

/*
  inputs:
  NSData *keyData;
  NSData *clearTextData
*/

uint8_t digest[CC_SHA1_DIGEST_LENGTH] = {0};

CCHmacContext hmacContext;
CCHmacInit(&hmacContext, kCCHmacAlgSHA1, keyData.bytes, keyData.length);
CCHmacUpdate(&hmacContext, clearTextData.bytes, clearTextData.length);
CCHmacFinal(&hmacContext, digest);

NSData *out = [NSData dataWithBytes:digest length:CC_SHA1_DIGEST_LENGTH]

Answer 1

Take a look at CocoaCryptoHashing for the SHA1 encoding

Answer 2

If you are calling the Amazon web service too look up prices or product details, your Amazon web service key will be disabled and your app will stop working.

Look at the terms of service of the Amazon Web Services, use by mobile clients is strictly disallowed:

https://affiliate-program.amazon.com/gp/advertising/api/detail/agreement.html

I found this out the hard way when my own application had my AWS key disabled in a production app. I had read the TOS, but it was not really there as you can see by the link above to some other obscure detail of use. You wouldn't think the affiliate program would have anything to do with the API, but it does.

You can find details of other apps blocked at this TechCrunch article:

http://www.techcrunch.com/2009/07/07/amazon-killing-mobile-apps-that-use-its-data/

Just giving you a heads up and hopefully saving you a lot of work.

Answer 3

I posted one solution to this here, that returns the Base64 encoded data that AWS requests.

Answer 4

I just spent like 4 hours Googling and looking for ways to calculate an unkeyed SHA1 on the iPhone that would match the results of the sha1() function in php. Here was the result:

    NSString *hashkey = <your data here>;
// PHP uses ASCII encoding, not UTF
const char *s = [hashkey cStringUsingEncoding:NSASCIIStringEncoding];
NSData *keyData = [NSData dataWithBytes:s length:strlen(s)];

// This is the destination
uint8_t digest[CC_SHA1_DIGEST_LENGTH] = {0};
// This one function does an unkeyed SHA1 hash of your hash data
CC_SHA1(keyData.bytes, keyData.length, digest);

// Now convert to NSData structure to make it usable again
NSData *out = [NSData dataWithBytes:digest length:CC_SHA1_DIGEST_LENGTH];
// description converts to hex but puts <> around it and spaces every 4 bytes
NSString *hash = [out description];
hash = [hash stringByReplacingOccurrencesOfString:@" " withString:@""];
hash = [hash stringByReplacingOccurrencesOfString:@"<" withString:@""];
hash = [hash stringByReplacingOccurrencesOfString:@">" withString:@""];
// hash is now a string with just the 40char hash value in it

Hopefully this will help others who are struggling with SHA1 on the iPhone

Answer 5

I just needed to SHA1-encrypt a password for a login procedure. The code works perfectly, thanks a lot, KeithF!

Answer 6

// This is my code used in my Twitter connection, and working well for me.
// KeithF's code was a big help!
//
// This is a category added to NSData.

@implementation NSData (EOUtil)
- (NSData*)dataByHmacSHA1EncryptingWithKey:(NSData*)key
{   
    void* buffer = malloc(CC_SHA1_DIGEST_LENGTH);
    CCHmac(kCCHmacAlgSHA1, [key bytes], [key length], [self bytes], [self length], buffer);
    return [NSData dataWithBytesNoCopy:buffer length:CC_SHA1_DIGEST_LENGTH freeWhenDone:YES];
}
@end

Answer 7

Hi, thought I would lend a thought to the alleged banning of mobile apps by amazon:

First off they don't say they are banning mobile apps, they say specifically:

(e) You will not, without our express prior written approval, use any Product Advertising Content on or in connection with any site or application designed or intended for use with a mobile phone or other handheld device.

In other words you will not mention anything Amazon in an app that generates affiliate revenue. I already had an amusing (in my view) conversation with how it would appear that the affiliate program itself then is inherently violating their policies, as one cannot advertise their products without mentioning them now can they? (I was exaggerating other parts of the terms where it pretty much does the same thing to websites, and you have to remember, I was given my 1 and only warning after selling 20 book readers that may or may not have anything to do with Amazon and is in no way related to a Kanoodle, in 12 hours, but hey rules are rules, I mean s***, the federal law outlawing "interstate transport of woman for immoral purposes" is the reason I don't date anything but homeless girls without a car, I'm Johny Law, whatever you say Amazon, Mr. Amazon sir).

But that is neither here nor there, on this one, that guy is wrong, Amazon will not as a general principal it appears, delete your account, ban you, exile you to availability zone antartica (always use A there, B is freeeezing), etc. for developing a mobile app --- just don't mess with the affiliate program. And trust me, they are determined to effectively kill that thing off one way or another (yes the affiliate program, and no I don't have any idea why, ask them...).