Weekly Code Drop:
Creating base-64 encoded HMAC
Signatures with Cocoa Touch.
Jason Hayes Christensen
jasonc411.com
July 4 Weekly Code Drop

A number of new authentication models use
base64 encoded HMAC-SHA1 and HMAC-
SHA2/256 signatures.
Amazon AWS uses HMAC-SHA1
OAuth uses HMAC-SHA1 and RSA-SHA1
OpenID uses HMAC-SHA1 and HMAC-SHA256
This is an overview of how to create these
signatures.
July 4 Weekly Code Drop

HMAC-SHA1 HMAC-SHA256 HMAC-MD5
HMAC stands for Hashed Message Authentication Code. The
postfix after the – is the signature method.
HMAC-SHA1 Most commonly encountered
HMAC-SHA256 More secure, but has been subject to a partially
successful cryptanalysis.
HMAC-MD5 Has been subject to a fully successful cryptanalysis.
July 4 Weekly Code Drop

HMAC in Cocoa
HMACs are easy to generate in Cocoa, one simply uses the
function:
CCHmac(signatureType,
(const void*)[key UTF8String],
[key length],
(const void*)[message UTF8String],
[message length],
(void*)hmacOutBuffer);
This call is in the function createEncodedHMACToken in the
sample..
The hmacOutBuffer should be of length 16+1 bytes for MD5, 20+1
bytes for SHA1, and 32+1 bytes for SHA256, the hash should be
null terminated
July 4 Weekly Code Drop

Base64 Enoding Fundamentals
Bas64 Encoding in Cocoa is a matter of creating your own.
Base64 encoding is used to convert binary data to text data. using
the non-control characters
General : A-Za-z0-9+/
URI safe: A-Za-z0-9-_
Filler Characters
General: '='
URI Safe: '*'
Filler characters are used when the three byte buffer has fewer
than three bytes in it..
July 4 Weekly Code Drop

Base64 Encoding Method
base256 numbers are represented in 8 bits
base64 can be represented in 6 bits.
8 and 6 have a Lowest Common Multiple of 24
3 bytes, or four base64 values.
We therefore take three bytes at a time and create four base64
values.
We concatenate the characters represented by each base64 value
in order into the return buffer.
July 4 Weekly Code Drop

Base64 Encoding Visually
FE3225
11111110 00110010 00100101
111111 100011 001000 100101
6 3 0 3
3 5 8 7
/ j I l /jIl
July 4 Weekly Code Drop

Base64 Encoding Loop
July 4 Weekly Code Drop

Setting up Unit Testing Step by Step
Right Click on Targets
Click Add->New Target...
July 4 Weekly Code Drop

Setting up Unit Testing Step by Step
Choose 'Unit Test Bundle',
then click 'Next'
July 4 Weekly Code Drop

Setting up Unit Testing Step by Step
Name the Bundle
Then click “Finish”
July 4 Weekly Code Drop

Setting up Unit Testing Step by Step
Double Click on the new bundle
This dialog will appear
Click on the + button
July 4 Weekly Code Drop

Setting up Unit Testing Step by Step
Add the project as a dependency,
Then click Add Target
July 4 Weekly Code Drop

Setting up Unit Testing Step by Step
For libraries,
we must also add the library,
So click on the lower +
July 4 Weekly Code Drop

Setting up Unit Testing Step by Step
Select the library then
Then click “Add”
July 4 Weekly Code Drop

Setting up Unit Testing Step by Step
Click the red button to close
July 4 Weekly Code Drop

Setting up Unit Testing Step by Step
Add a new file group to the project,
Right click on the project
Then select Add->New Group
Finally, name the new Group “Tests” or something similar
July 4 Weekly Code Drop

Setting up Unit Testing Step by Step
Add a new file to the Tests group
Right click on Tests
Then select Add->New File...
July 4 Weekly Code Drop

Setting up Unit Testing Step by Step
Select Objective-C test class,
Then click Next
July 4 Weekly Code Drop

Setting up Unit Testing Step by Step
Name the test class,
select include header,
choose the Test target
As shown
July 4 Weekly Code Drop

Setting up Unit Testing Step by Step
When ready to run unit tests,
set the test bundle as the
primary target,
Then build.
If tests fail, you will
get build errors.
July 4 Weekly Code Drop

Conclusion
What we looked at:
Who in cloud, and auth use HMAC-SHA*** tokens.
How to sign the message.
How to do a base64 encoding
How to setup unit testing
The code is BSD license, feel free to use it, but there
are no warranties explicit or implied, as it is purely for
purposes of demonstration.
The code can be accessed at:
http://jasonc411.com/downloads.html
July 4 Weekly Code Drop