无法使HMACsha256产生预期的结果

Question

I'm trying to hook into the Binance API and have discovered that my implementation of HMACsha256 isn't producing the results that the sample documentation (and doing it in the command line) can. I'm trying to improve my knowledge of Go, but can't seem to crack this one.

Here's the documentation (Relevant Sample at "SIGNED Endpoint Examples for POST /api/v1/order"): https://github.com/binance-exchange/binance-official-api-docs/blob/master/rest-api.md

Without looking at the doc, here is the gist, my key is the following:

NhqPtmdSJYdKjVHjA7PZj4Mge3R5YNiP1e3UZjInClVN65XAbvqqM6A7H5fATj0j

my value is the following:

symbol=LTCBTC&side=BUY&type=LIMIT&timeInForce=GTC&quantity=1&price=0.1&recvWindow=5000&timestamp=1499827319559

When I use the terminal with the following command:

echo -n "symbol=LTCBTC&side=BUY&type=LIMIT&timeInForce=GTC&quantity=1&price=0.1&recvWindow=5000&timestamp=1499827319559" | openssl dgst -sha256 -hmac "NhqPtmdSJYdKjVHjA7PZj4Mge3R5YNiP1e3UZjInClVN65XAbvqqM6A7H5fATj0j"

I receive the result

c8db56825ae71d6d79447849e617115f4a920fa2acdcab2b053c4b2838bd6b71

Which is what the documentation suggests. But when I use the following go program:

package main

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/base64"
    "fmt"
)

func main() {
    docSecret := "NhqPtmdSJYdKjVHjA7PZj4Mge3R5YNiP1e3UZjInClVN65XAbvqqM6A7H5fATj0j"
    docQuery := "symbol=LTCBTC&side=BUY&type=LIMIT&timeInForce=GTC&quantity=1&price=0.1&recvWindow=5000&timestamp=1499827319559"
    result := hmacify(docQuery, docSecret)
    fmt.Println(result)
}

func hmacify(message string, secret string) string {
    key := []byte(secret)
    h := hmac.New(sha256.New, key)
    h.Write([]byte(message))
    return base64.StdEncoding.EncodeToString(h.Sum(nil))
}

produces the result:

yNtWglrnHW15RHhJ5hcRX0qSD6Ks3KsrBTxLKDi9a3E=

What am I misunderstanding that's causing such a massive difference from the sample and command line?

Answer 1

You got the same result in both cases. It's just encoded differently. The openssl command encodes it as hex and your function uses base64.StdEncoding.EncodeToString() to encode it as base64.

Here's a small Python 2 snippet showing this:

>>> x = "c8db56825ae71d6d79447849e617115f4a920fa2acdcab2b053c4b2838bd6b71"
>>> y = "yNtWglrnHW15RHhJ5hcRX0qSD6Ks3KsrBTxLKDi9a3E=".decode('base64').encode('hex')
>>> y
'c8db56825ae71d6d79447849e617115f4a920fa2acdcab2b053c4b2838bd6b71'
>>> x == y
True

To get the exact same result as the command line use hex.EncodeToString() as @Anuruddha suggested.

import "encoding/hex"

func hmacify(message string, secret string) string {
    key := []byte(secret)
    h := hmac.New(sha256.New, key)
    h.Write([]byte(message))
    return hex.EncodeToString(h.Sum(nil))  // <--- change is HERE
}