2

We are calling a service from salesforce. This service is expecting a specific hash in the httpHeaders collection of the HTTP Request.

The service is written in .NET and the hash is computed using SHA384 in C#. Here is the sample C# code.

SHA384 shaM = new SHA384Managed();
    byte[] bye = Encoding.ASCII.GetBytes("IAMSTUMPED");
    byte[] buffer = shaM.ComputeHash(bye);
    StringBuilder sb = new StringBuilder();
    for (int i = 0; buffer != null && i < buffer.Length; i++) 
    {
        sb.AppendFormat("{0:x2}", buffer[i]);
    }
        Console.WriteLine(sb.ToString());

Output of this is:

199978467e452a6a937f90936e058dd9556412c0479fc3471d27f29135ecbcec534f8b29cd8ef6a38de9250237f603e8

How can I get Apex to produce the same output as the .NET code? I don't want to hard-code the hash since the key in the example can be changed multiple times.

I am going through the documentation on Crypto class and the method that looks most promising is generateDigest. This does not seem to support SHA384.

Here is my apex code.

Blob urlBlob = Blob.valueOf('IAMSTUMPED');
Blob encryptedData = Crypto.generateDigest('MD5', urlBlob);
string token = EncodingUtil.base64Encode(encryptedData);
System.Debug(token);
//Outputs: CKl2baWkEngT4+gXasfpeA==
encryptedData = Crypto.generateDigest('SHA1', urlBlob);
token = EncodingUtil.base64Encode(encryptedData);
System.Debug(token);
//Outputs: Ak/2rdtJWyVe2/lXgoBnojmSGqM=
encryptedData = Crypto.generateDigest('SHA-256', urlBlob);
token = EncodingUtil.base64Encode(encryptedData);
System.Debug(token);
//Outputs: 4Oq4exMWa9kNcNVj3Gu4Ce3+9/rUVE5yrqRpc7NZCdw=
encryptedData = Crypto.generateDigest('SHA-512', urlBlob);
token = EncodingUtil.base64Encode(encryptedData);
System.Debug(token);
//Ouputs: 290Z3HYWsWtEqqtIgMvr2UxilQmJVnwAQKbeOxAZ6ousKC9ZbvoTbzOXfzA71SRYTNLQXos9xJT2ZnSst7i3hw==

I have tried using every single algorithm that is listed in the documentation. How can I generate the same hash that the C# code is generating?

8
  • 1
    Did you try SHA-384 itself? Just because it is not documented does not mean it's not worth testing.
    – Adrian Larson
    Nov 9, 2016 at 17:13
  • In addition to the above - Your blob in the C# is IAMNOWSTUMPED yet in the apex code you are using a different value IAMSTUMPED.
    – Eric
    Nov 9, 2016 at 17:13
  • 1
    is changing the C# code to use one of the algorithms that Salesforce is documented to support not an option?
    – Derek F
    Nov 9, 2016 at 17:14
  • @Eric Yes. I realized that later, but the problem still exists. I am using the same values now.
    – abhi
    Nov 9, 2016 at 17:15
  • 1
    Your C# output is hex, but your Apex output is base64 encoded. Convert one to the other, and it should match.
    – Derek F
    Nov 9, 2016 at 17:28

1 Answer 1

1

I think Adrian pointed me in the right direction here. The SHA-384, although not documented is supported by the Crypto class. So I had to make a slight change to my code. Here is my code that creates the same output as the C# code. I have tested this with a couple of keys other than "IAMSTUMPED" and they produce the same output.

Blob urlBlob = Blob.valueOf('IAMSTUMPED');
Blob encryptedData = Crypto.generateDigest('SHA-384', urlBlob);
string token = EncodingUtil.convertToHex(encryptedData);
System.Debug(token);
3
  • 1
    Given that SHA-384 is not documented and that the underlying implementation may be provider based and Salesforce might choose to change providers there is a (small?) chance that SHA-384 support might be removed as a side effect in the future. I would create a case to check if this is a supported platform feature i.e. a documentation miss rather than an accidental feature not checked by tests.
    – Keith C
    Nov 9, 2016 at 18:28
  • Good point. I will get on it rightaway. Also I have requested the service providers to switch to SHA-512 which is documented in Apex. However that may not happen or take a very long time.
    – abhi
    Nov 9, 2016 at 19:02
  • Yep - smart to see where you can get to taking both approaches.
    – Keith C
    Nov 9, 2016 at 20:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .