HMAC Base64 Authentication?

Question

I have no clue what's even going on in this but I am attempting to use an API and they have yet another different authentication standard called HMAC with Sha384 to base64.

This is the example provided:

class ICObenchAPI {

private $privateKey = 'private-key';
private $publicKey  = 'public-key';
private $apiUrl     = 'https://icobench.com/api/v1/';
public  $result;

public function getICOs($type = 'all', $data = ''){ 
    return $this->send('icos/' . $type, $data); 
}   
public function getICO($icoId, $data = ''){ 
    return $this->send('ico/' . $icoId, $data); 
}       
public function getOther($type){ 
    return $this->send('other/' . $type, ''); 
}

private function send($action, $data){

    $dataJson = json_encode($data);                 
    $sig = base64_encode(hash_hmac('sha384', $dataJson, $this->privateKey, true));  

    $ch = curl_init($this->apiUrl . $action);
    curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "POST"); 
    curl_setopt($ch, CURLOPT_POSTFIELDS, $dataJson);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_HTTPHEADER, array(
        'Content-Type: application/json',
        'Content-Length: ' . strlen($dataJson),
        'X-ICObench-Key: ' . $this->publicKey,
        'X-ICObench-Sig: ' . $sig)
    );

    $reply = curl_exec($ch);
    $ff = $reply;
    $reply = json_decode($reply,true);

    if(isset($reply['error'])){
        $this->result = $reply['error'];
        return false;
    }else if(isset($reply['message'])){
        $this->result = $reply['message'];
        return true;
    }else if(isset($reply)){
        $this->result = json_encode($reply);
        return true;
    }else{
        $this->result = htmlspecialchars($ff);
        return false;
    }
}

public function result(){
    return $this->result;
}

}

I'm looking to take the PHP example provided and turn it into a nodeJS script, just really don't know where to start. I've looked at crypto-js and others but just don't comperhend what specifically is happening in the request to make since of what i'm even writing

Answer 1

Crypto-js is the good way to do.

You need to first encrypt your data and then Base64 it to create a signature used in header

    let dataJSON = JSON.stringify(data);

    let sign = CryptoJS.HmacSHA384(dataJSON, this.privateKey);
    sign = CryptoJS.enc.Base64.stringify(sign);

I pushed on github a working example : ICObenchAPI.js

Answer 2

I wrote a Node js wrapper library called node-icobench . You are welcome to use it.

npm install node-icobench

Here is a sneak peek to the HMAC part with a few alterations for the sake of this example:

const crypto = require('crypto');

// Stringify POST data
let jsonData = JSON.stringify(data);

// Create HMAC based on algo and private key
let hmac = crypto.createHmac('sha384', privateKey);

// Create HMAC Digest of json data
hmac.update(jsonData);

// return Base64 encoding of HMAC
let signedData = hmac.digest('base64');