topic Re: UTF-8 Byte Array and Base64 Decode? in SAS Programming

UTF-8 Byte Array and Base64 Decode?

SteveNZ — Tue, 01 Sep 2020 23:07:59 GMT

Hi All,

To authenticate an API call with a provider we use I need to produce a digest which is proving pretty challenging. The steps to produce are:

Concatenate all the fields in the table above in order (the nonce is a UUID)
fields = client-id + nonce + timestamp-epoch + http-method + http-url
Produce a UTF-8 byte array of the concatenated string in Step (1)
fields_bytes = UTF8(fields)
Base-64 decode the supplied ClientSecret
secret_bytes = Base64Decode(ClientSecret)
Compute HMAC-256 on the string from Step (2) using the signing key from Step (3)
digest = HMAC256(fields_bytes, secret_bytes)

I've managed (by much Googling..) to do step one but am at a loss as to how to do steps 2 and 3 in SAS? Has anyone tackled something similar?

I am also making an assumption that the code below is the SAS equivalent of Step 4?

digest = SHA256(concatenated_field_secret) ;

Many thanks in advance, I've tried various attempts but none seem right.

Code so far is (anonymised):

data fields (keep =  fields);
	*nonce;
	nonce = UUIDGEN();

	*timestamp-epoch;
	dt = datetime();
	unixEpoch = dhms('01jan1970'd,0,0,0);
	epoch = sum(dt,-unixEpoch);

	*fields;
	fields = catx('+','CLIENT_ID',nonce,epoch,'POST','https://API_PROVIDER/media/search HTTP/1.1');
run;

warm regards

Steve

Re: UTF-8 Byte Array and Base64 Decode?

ChrisNZ — Wed, 02 Sep 2020 06:26:06 GMT

Not too sure what step 2 means, all the characters you have encode the same in ASCII and UTF8.

About step 3, this is how to use base64 encoding:

data TEST;
  ENCODE = put('12345abcde',$base64x20.);
  DECODE = input(ENCODE,$base64x20.);
run;

About step 4, you probably want to use function HASHING_HMAC.

Re: UTF-8 Byte Array and Base64 Decode?

SteveNZ — Thu, 03 Sep 2020 20:56:45 GMT

Thanks Chris, really appreciate the response and I'll give your suggestions a try. I have anonymised the post as it had my client specific client-id, is there a way you know of that can encode?

Re: UTF-8 Byte Array and Base64 Decode?

SteveNZ — Thu, 03 Sep 2020 21:06:13 GMT

Just checked and the HASHING_MAC function is available only from 9.4M6 and we're on M4....

Re: UTF-8 Byte Array and Base64 Decode?

SASKiwi — Thu, 03 Sep 2020 22:25:46 GMT

@SteveNZ - The MD5 function works great for anonymising IDs and we are on 9.4M2. We do something like this:

Client_Key = md5(cats('ClientID', Client_ID)),$hex10.);

Re: UTF-8 Byte Array and Base64 Decode?

ChrisNZ — Fri, 04 Sep 2020 01:09:08 GMT

SHA256 is safer than MD5.

MD5 vulnerabilities have been discovered, so it is no longer recommended for that cryptography.