UTF-8 Byte Array and Base64 Decode?

[SteveNZ]

Hi All,

To authenticate an API call with a provider we use I need to produce a digest which is proving pretty challenging. The steps to produce are:

1. Concatenate all the fields in the table above in order (the nonce is a UUID)
   fields = client-id + nonce + timestamp-epoch + http-method + http-url
   
   
2. Produce a UTF-8 byte array of the concatenated string in Step (1)
   fields_bytes = UTF8(fields)
   
   
3. Base-64 decode the supplied ClientSecret
   secret_bytes = Base64Decode(ClientSecret)
   
   
4. Compute HMAC-256 on the string from Step (2) using the signing key from Step (3)
   digest = HMAC256(fields_bytes, secret_bytes)

I've managed (by much Googling..) to do step one but am at a loss as to how to do steps 2 and 3 in SAS? Has anyone tackled something similar?

I am also making an assumption that the code below is the SAS equivalent of Step 4?

digest = SHA256(concatenated_field_secret) ;

Many thanks in advance, I've tried various attempts but none seem right.

Code so far is (anonymised):

data fields (keep =  fields);
	*nonce;
	nonce = UUIDGEN();

	*timestamp-epoch;
	dt = datetime();
	unixEpoch = dhms('01jan1970'd,0,0,0);
	epoch = sum(dt,-unixEpoch);

	*fields;
	fields = catx('+','CLIENT_ID',nonce,epoch,'POST','https://API_PROVIDER/media/search HTTP/1.1');
run;

warm regards

Steve

[ChrisNZ]

Not too sure what step 2 means, all the characters you have encode the same in ASCII and UTF8.

About step 3, this is how to use base64 encoding:

data TEST;
  ENCODE = put('12345abcde',$base64x20.);
  DECODE = input(ENCODE,$base64x20.);
run;

About step 4, you probably want to use function HASHING_HMAC.

[SteveNZ]

Thanks Chris, really appreciate the response and I'll give your suggestions a try. I have anonymised the post as it had my client specific client-id, is there a way you know of that can encode?

[SteveNZ]

Just checked and the HASHING_MAC function is available only from 9.4M6 and we're on M4....

[SASKiwi]

@SteveNZ - The MD5 function works great for anonymising IDs and we are on 9.4M2. We do something like this:

Client_Key = md5(cats('ClientID', Client_ID)),$hex10.);

[ChrisNZ]

SHA256 is safer than MD5.

MD5 vulnerabilities have been discovered, so it is no longer recommended for that cryptography.