Go HMAC-SHA512 vs Python HMAC-SHA512

[Aido]

Hi all,

I'm learning Go and am having a bit of trouble implementing HMAC-
SHA512 funtionality.

In my example Go code (http://pastebin.com/pK1L4x8V) I first decode a
base64 encoded key which is then used to sign my message data. The
HMAC-SHA512 output is then base64 encoded and prints the following:

klt0ddox7gczB55KiCFkQuX4cFFsrPAgKdywC62FjLBJYToKb3MbI0TiUTMeZURKThDOAWdPpMW­
MTRQ0GdQTLg==

This is incorrect.

When I use the exact same message data and base64 encoded key in
Python (http://pastebin.com/PkWkcNHU) I get the correct output:

fRCWEHlddwwZi/8cAZ869OU6DdExpVov06X/
KHPu62uTzFliPLIuLnwEZpGAHuGuUkim15z9bnLH1yECTrLT+Q==

From performing some further tests I see that when I change the hash
to SHA256 both Go and Python have the same correct output:

4chHornjt5iljaDzzGKFpvON7U7YWIBlWdbNJ+6dy0o=

So, it seems my Go SHA512 hash is falling down somewhere but I can't
figure out where.

Any ideas on where I'm going wrong?

Thanks in advance.

[Damian Gryski]

I believe hmac+sha512 was just recently added to Go: http://code.google.com/p/go/source/detail?r=728321e6dbea

The issue was the hmac implementation assumed a blocksize of 16, which is only valid for MD5 and SHA1.  As you are still running an older release of Go (as your code has os.Error and shash.Sum() instead of shash.Sum(nil)), this functionality is missing.

It will, however, be present in Go 1, the next stable release.

HTH,

Damian

[Aido]

Thanks for the speedy response Damian.

I assumed I was using the latest version of Go.

I followed the 'Getting Started' section and only a few hours ago
checked out the source from the repository with the following command:

hg clone -u release https://go.googlecode.com/hg/ go

I was not aware of changes to os.Error and shash.Sum().

At least I now know that, for once, the root of my problem is not my
code. It was a bit of a head scratcher for me.

[Ian Lance Taylor]

Aido <aidank...@googlemail.com> writes:

> I assumed I was using the latest version of Go.
>
> I followed the 'Getting Started' section and only a few hours ago
> checked out the source from the repository with the following command:
>
> hg clone -u release https://go.googlecode.com/hg/ go

You are using the latest release (due to "-u release"), but Damian was
referring to changes since the latest release. The latest release was
actually a while ago, because of the push toward the long-term-stable Go
1 release.

Ian

[Aido]

Hi,

 

I am now using the very latest version of Go and SHA512 is working. Thanks again for the assistance.

 

Just out of curiosity, roughly how often are stable versions of Go released? And, since the latest release was a good while ago, when is the next one due? Or are these a 'how long is a piece of string' questions?

 

Regards,

Aido

[Ian Lance Taylor]

Aido <aidank...@gmail.com> writes:

> Just out of curiosity, roughly how often are stable versions of Go
> released? And, since the latest release was a good while ago, when is the
> next one due? Or are these a 'how long is a piece of string' questions?

http://blog.golang.org/2011/10/preview-of-go-version-1.html

Ian