recurly/recurly-client-python — Issue #10: Signature Signing Incorrect?
Author: talibsharif
Created: 2011-11-11 20:07:00+00:00
State: open

I was testing my Java Port of the signature signing mechanism. I was using the Python version of the signature signing as a reference test. I could not get the Java Version of the signature to match the Python version. I also tried several online tools for signature signing and they would agree with the Java Version of my output and not the Python version. After a long head scratching, i think the bug is in Python version.

The python code in question in js.py
key = hashlib.sha1(PRIVATE_KEY).digest()
signer = hmac.new(key, message, hashlib.sha1)

shouldn't it be the following?
signer = hmac.new(PRIVATE_KEY, message, hashlib.sha1)

The test case i was using is:
PRIVATE_KEY = '0cc86846024a4c95a5dfd3111a532d13'
js.sign_billing_info_update("ABC", 1312701386)

the message it would produce is :
[1312701386,billinginfoupdate,[account_code:ABC]]
Output:
'94c1af938a64b0d535dab615f7ba62cea9ffbc6f-1312701386'

So the signature is
94c1af938a64b0d535dab615f7ba62cea9ffbc6f

And when using online tool or my Java Program is the following:
6afcdb714a0eae4d68048649f25677c3fa780257

Online Tool Used:
http://hash.online-convert.com/sha1-generator

BTW, i was trying to replicate the signature generation example on the recurly site using the test key and test timestamp.
http://docs.recurly.com/recurlyjs/signatures/spec

-Talib