JavaScript加密哈希转换为Python 3

Question

I am trying to make a Python 3 application to download weather data from my account at http://www.osanywhereweather.com . I have found JavaScript source code that does exactly this at https://github.com/zrrrzzt/osanywhereweather . I am assuming that the github code works. When inspecting the source of osanywhereweather.com, it seems to me that the github code resembles that very much.

I am new to Python 3 and I have never coded in JavaScript, and I know nothing about cryptographics. I have, however, done a fair share of coding over the last 35 or years, so I read code fairly well. I therefore thought it would be relatively easy to translate the github JavaScript code to Python 3. I was wrong, it seems.

The code of interest is the part of the code that hashes e-mail and password together with a "challenge" received from osanwhereweather.com in order to authenticate me.

I have not been able to test the JavaScript code, but as I said I think it compares well with the source of the osanywhereweather.com page. By analyzing the traffic in my web browser, I can see the information exchanged between osanywhereweather.com and my browser, so that I have got a consistent set of challenge and saltedHash .

When trying to create the same saltedHash based on the corresponding challenge with my Python 3 code, I get a different result.

I have tried internet searches to see if I can find out what I'm doing wrong, but to no avail. If anyone is proficient in JavaScript, Python and cryptographics and is able to point out what I'm doing wrong, I would indeed be grateful.

JavaScript code:

'use strict';

var crypto = require('crypto');

function osaHash(email, password) {
  var shasum = crypto.createHash('sha1').update(email);
  var e = '$p5k2$2710$' + shasum.digest('hex').toString().substring(0, 8);
  var res = crypto.pbkdf2Sync(password, e, 1e4, 32, 'sha256');
  var r = res.toString('base64').replace(/\+/g, '.');

  return e + '$' + r;
}

function createHash(opts, callback) {

  if (!opts) {
    return callback(new Error('Missing required input: options'), null);
  }

  if (!opts.email) {
    return callback(new Error('Missing required param: options.email'), null);
  }

  if (!opts.password) {
    return callback(new Error('Missing required param: options.password'), null);
  }

  if (!opts.challenge) {
    return callback(new Error('Missing required param: options.challenge'), null);
  }

  var hash = osaHash(opts.email, opts.password);
  var hmac = crypto.createHmac('sha1', hash).update(opts.challenge);
  var saltedHash = hmac.digest('hex');

  return callback(null, saltedHash);
}

module.exports = createHash;

Python 3 code:

import hmac
import hashlib
import base64

e_mail = 'me@mydomain.com'
password = 'Secret'

''' challenge is received from osanywhereweather.com '''
challenge = '15993b900f954e659a016cf073ef90c1' 

shasum           = hashlib.new('sha1')
shasum.update(e_mail.encode())
shasum_hexdigest = shasum.hexdigest()
shasum_substring = shasum_hexdigest[0:8]
e                = '$p5k2$2710$' + shasum_substring

res = hashlib.pbkdf2_hmac('sha256',password.encode(),e.encode(),10000,32)
r = base64.b64encode(res,b'./')
hashstr = str(e) + '$' + str(r)

hmac1 = hmac.new(challenge.encode(), hashstr.encode(), 'sha1')
saltedHash = hmac1.hexdigest()

Answer 1

hashstr = str(e) + '$' + str(r)

In the above line, str(r) will give you: "b'ZogTXTk8T72jy01H9G6Y0L7mjHHR7IG0VKMcWZUbVqQ='" .

You need to use r.decode() to get "ZogTXTk8T72jy01H9G6Y0L7mjHHR7IG0VKMcWZUbVqQ=" .

hashstr = str(e) + '$' + r.decode()

UPDATE 1

Arugments to hmac.new should be fixed:

hmac1 = hmac.new(hashstr.encode(), challenge.encode(), 'sha1')

UPDATE 2

According to OP's comment, OP doesn't need to do the following.

Another thing is that, crypto.pbkdf2Sync seems does not respect digest argument. It seems always use sha1 digest (At least in my system, NodeJS 0.10.25). So you need to specify sha1 in python side:

res = hashlib.pbkdf2_hmac('sha1', password.encode(), e.encode(), 10000, 32)

Answer 2

Based on falsetru's response, the following Python 3 code has been verified to work with the osanywhereweather.com site:

import hmac
import hashlib
import base64

e_mail = 'me@mydomain.com'
password = 'Secret'

''' challenge is received from osanywhereweather.com '''
challenge = '15993b900f954e659a016cf073ef90c1' 

shasum           = hashlib.new('sha1')
shasum.update(e_mail.encode())
shasum_hexdigest = shasum.hexdigest()
shasum_substring = shasum_hexdigest[0:8]
e                = '$p5k2$2710$' + shasum_substring

res = hashlib.pbkdf2_hmac('sha256',password.encode(),e.encode(),10000,32)
r = base64.b64encode(res,b'./')
hashstr = str(e) + '$' + r.decode()

hmac1 = hmac.new(hashstr.encode(), challenge.encode(), 'sha1')
saltedHash = hmac1.hexdigest()

Thank you to falsetru!