public void BadSignatureEmptyLength(string badSignature)
{
//Online HMAC tester: https://www.devglan.com/online-tools/hmac-sha256-online
var input = new TestModelInclusive();
var calculator = new HMACSHA256SignatureCalculator();
var sut = new InstanceSignatureBuilder(calculator);
sut.VerifyHex(input, badSignature, knownKey).Should().BeFalse();
}
public void PropertiesImplicitlyIncludedInCalculation()
{
//Online HMAC tester: https://www.devglan.com/online-tools/hmac-sha256-online
const string signature = "8feda6b02259091f6d58b53f5bf5645586fe38694c43d50c4e06f51265ed84a9";
var input = new TestModelInclusive();
var calculator = new HMACSHA256SignatureCalculator();
var sut = new InstanceSignatureBuilder(calculator);
sut.VerifyHex(input, signature, knownKey).Should().BeTrue();
}
public void PropertiesPartialExclusionsWithCalculation()
{
var input = new TestModelPartialExclusions();
var calculator = A.Fake <ISignatureCalculator>();
A.CallTo(() => calculator.Calculate(A <string> ._, A <string> ._))
.ReturnsLazily((string name, string key) => new SignatureCalculation(string.Empty, name));
var sut = new InstanceSignatureBuilder(calculator);
var actual = sut.Compute(input, knownKey);
actual.PayloadAsASCIIString().Should()
.Be(
"Field3Ifalistenernodshisheadwhenyou'reexplainingyourprogram,wakehimup.Field42147483647Field5trueField6true");
}
public void PropertiesImplicitlyIncludedInCalculation()
{
var input = new TestModelInclusive();
var calculator = A.Fake <ISignatureCalculator>();
A.CallTo(() => calculator.Calculate(A <string> ._, A <string> ._))
.ReturnsLazily((string name, string key) => new SignatureCalculation(string.Empty, name));
var sut = new InstanceSignatureBuilder(calculator);
var actual = sut.Compute(input, knownKey);
actual.PayloadAsASCIIString().Should()
.Be(
"Field1Oneman'sconstantisanotherman'svariable.Field22147483647Field39223372036854775807Field43.4028235E+38Field51.7976931348623157E+308Field69999-12-31T23:59:59.9999999Field7true");
}
public void PropertiesPartialExclusionsWithCalculation()
{
//Online HMAC tester: https://www.devglan.com/online-tools/hmac-sha256-online
var expected = new SignatureCalculation(
"9bac02d1fb108ec1581000627cf4b4edf99976761012a56a44d9bbb4829edba4",
"Field3Ifalistenernodshisheadwhenyou'reexplainingyourprogram,wakehimup.Field42147483647Field5trueField6true"
);
var input = new TestModelPartialExclusions();
var calculator = new HMACSHA256SignatureCalculator();
var sut = new InstanceSignatureBuilder(calculator);
var actual = sut.Compute(input, knownKey);
actual.Should().BeEquivalentTo(expected);
}
public void PropertiesImplicitlyIncludedInCalculation()
{
//Online HMAC tester: https://www.devglan.com/online-tools/hmac-sha256-online
var expected = new SignatureCalculation(
"8feda6b02259091f6d58b53f5bf5645586fe38694c43d50c4e06f51265ed84a9",
"Field1Oneman'sconstantisanotherman'svariable.Field22147483647Field39223372036854775807Field43.4028235E+38Field51.7976931348623157E+308Field69999-12-31T23:59:59.9999999Field7true"
);
var input = new TestModelInclusive();
var calculator = new HMACSHA256SignatureCalculator();
var sut = new InstanceSignatureBuilder(calculator);
var actual = sut.Compute(input, knownKey);
actual.Should().BeEquivalentTo(expected);
}
public void BuildSignatureAndVerifyExample_Base64()
{
// Any input. Even an anonymous type will do.
var input = new
{
Id = 1,
Name = "Hello World",
CreatedDate = DateTime.MaxValue
};
// Secret key shared between the sender and receiver.
var sharedSecretKey = "This is the key shared between the signature creator and signature verifier";
// Sender computes signature.
var signatureBuilder = new InstanceSignatureBuilder(new HMACSHA256SignatureCalculator());
var signatureResult = signatureBuilder.Compute(input, sharedSecretKey);
_output.WriteLine($"ASCII Payload used to calculate signature: {signatureResult.PayloadAsASCIIString()}");
_output.WriteLine($"Signature in Base64: {signatureResult.SignatureAsBase64String()}");
// receiver verifies signature, positive verification when sender and receiver key matches.
var verificationStatus = signatureBuilder.VerifyBase64(input, signatureResult.SignatureAsBase64String(), sharedSecretKey)
? "verified"
: "incorrect";
_output.WriteLine($"Signature Validity: {verificationStatus}");
// receiver verifies signature, negative verification.
// This test should fail in the case where either the signature or the key is different from original provided values.
// In the example below, a different key is used when comparing signatures.
var verificationStatusForcedFailure = signatureBuilder.VerifyBase64(input, signatureResult.SignatureAsBase64String(), "Any different key will force an incorrect verification.")
? "verified"
: "incorrect";
_output.WriteLine($"Signature Validity: {verificationStatusForcedFailure} (Forced failure using mismatched secret keys)");
}
