Skip to content

Incorrect HMAC result! #5499

@kirked

Description

@kirked

Trello uses the crypto subsystem to provide authentication for webhooks. In some cases an incorrect HMAC is being returned by that subsystem.

In the following snippets, the dash is a 3-byte character:

var crypto = require('crypto');
var hmac = crypto.createHmac('sha1', 'mysecretkey')
hmac.update('{"text":"Accountant I – Corporate Services"}}}https://b985c0c0.ngrok.io/listUpdate').digest('base64')
// ==> 'Zds0ZYuJRAiQnh1utYJjgYW1TLA='
echo -n '{"text":"Accountant I – Corporate Services"}}}https://b985c0c0.ngrok.io/listUpdate' | openssl dgst -sha1 -hmac "mysecretkey" -binary | base64
wnoQmp4wveV73iYetjeaq82WgUY=
  • Version: v5.7.0
  • Platform: Darwin xxx.local 15.3.0 Darwin Kernel Version 15.3.0: Thu Dec 10 18:40:58 PST 2015; root:xnu-3248.30.4~1/RELEASE_X86_64 x86_64
  • Subsystem: crypto

Metadata

Metadata

Assignees

No one assigned

    Labels

    cryptoIssues and PRs related to the crypto subsystem.

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions