Analysis and Evaluation of the Windows Event Log - Bill Buchanan

Barrie Codona, BSc (Hons) Network Computing, 2007
5.4.3 HMAC Checksum
Figure 33 shows the code that was used to calculate the second HMAC value. This
key value is calculated on the key that the user has entered in the viewer. It is then
displayed on the screen. Both the ‘new’ and ‘old’ values are then compared to see if
they match. Depending upon the results of the comparison an appropriate message is
displayed to the user. This method works because with HMAC so long as the key and
data remain constant the output will be the same.
// Declare a anew instance of Ascii Encoding.
System.Text.ASCIIEncoding encoding = new System.Text.ASCIIEncoding();
byte[] keyByte = encoding.GetBytes(hmacTxt.Text);
// Declare new instance of HMAC.
HMACSHA1 hmac = new HMACSHA1(keyByte);
// Convert the message to be checked into bytes.
byte[] messageBytes = encoding.GetBytes(chkMessage);
// Calculate the HMAC value of the message.
byte[] hashmessage = hmac.ComputeHash(messageBytes);
// Display the ‘new’ hmac value on screen.
hmacCheckLbl.Text = ByteToString(hashmessage);
// Compare the values of the one on file to the new one.
if (hmacCheckLbl.Text == hmacLbl.Text)
{
// If they are the same.
hmacCheckLbl.Text += " : Hmac Passed!";
}
Else
{
// If the are different.
hmacCheckLbl.Text += " : Hmac Failed!";
}
5.5 Conclusions
Figure 33: Checking the hash signature
The data that is being transferred to the Data Archiving System is successfully being
encrypted using RSA. This is regarded as a secure form of encryption that uses
complex mathematics to encrypt and decrypt data. There are also two keys involved,
one public key and one private key. The public key can only be used for encrypting a
message and is given to the person that is sending the message. Only the paired
private key is able to decrypt that message.
All three components of the application make full use of HMAC signature hashing as
method for authenticating the messages that have been received from the event logger
49