OpenSSL HMACSHA256 produces different result comparing to .NET

Question

I am using C# and C++ with OpenSSL to compute HMACSHA256 has with a key and both produce different results. What am I doing wrong?

C# code:

public static string CreateSignature(string signingString, string sharedKey)
{
    var key = Encoding.ASCII.GetBytes(sharedKey);
    var hmac = new HMACSHA256(key);
    var data = Encoding.ASCII.GetBytes(signingString);
    var hash = hmac.ComputeHash(data);

    return Convert.ToBase64String(hash);
}

C++ code:

std::string SignatureProvider::getSignature(std::string stringToSign, std::string key)
{
    const char* pKey = key.c_str();
    const char* pData = stringToSign.c_str();
    unsigned char* result = nullptr;
    unsigned int len = 32;

    result = (unsigned char*)malloc(sizeof(char) * len);

    HMAC_CTX ctx;
    HMAC_CTX_init(&ctx);
    HMAC_Init_ex(&ctx, pKey, strlen(pKey), EVP_sha256(), NULL);

    HMAC_Update(&ctx, (unsigned char*)&pData, strlen(pData));
    HMAC_Final(&ctx, result, &len);
    HMAC_CTX_cleanup(&ctx);

    return base64_encode(result, len);
}

std::string base64_encode(unsigned char const* bytes_to_encode, unsigned int in_len) 
{
    std::string ret;
    int i = 0;
    int j = 0;
    unsigned char char_array_3[3];
    unsigned char char_array_4[4];

    while (in_len--) {
        char_array_3[i++] = *(bytes_to_encode++);
        if (i == 3) {
            char_array_4[0] = (char_array_3[0] & 0xfc) >> 2;
            char_array_4[1] = ((char_array_3[0] & 0x03) << 4) + ((char_array_3[1] & 0xf0) >> 4);
            char_array_4[2] = ((char_array_3[1] & 0x0f) << 2) + ((char_array_3[2] & 0xc0) >> 6);
            char_array_4[3] = char_array_3[2] & 0x3f;

            for (i = 0; (i <4); i++)
                ret += base64_chars[char_array_4[i]];
            i = 0;
        }
    }

    if (i)
    {
        for (j = i; j < 3; j++)
            char_array_3[j] = '\0';

        char_array_4[0] = (char_array_3[0] & 0xfc) >> 2;
        char_array_4[1] = ((char_array_3[0] & 0x03) << 4) + ((char_array_3[1] & 0xf0) >> 4);
        char_array_4[2] = ((char_array_3[1] & 0x0f) << 2) + ((char_array_3[2] & 0xc0) >> 6);

        for (j = 0; (j < i + 1); j++)
            ret += base64_chars[char_array_4[j]];

        while ((i++ < 3))
            ret += '=';
    }
    return ret;
}

I just included base64 conversion for completeness, but it is already different before it.

Answer 1

Why don't you use HMAC function itself? I have tried with this code and both C++ and c# code result in same HMAC :

std::string getSignature(std::string stringToSign, std::string key)
{
    const char* pKey = key.c_str();
    const char* pData = stringToSign.c_str();
    unsigned char* result = nullptr;
    unsigned int len = 32;

    result = (unsigned char*)malloc(sizeof(char) * len);
    int nkeyLen = strlen(pKey);
    int dataLen = strlen(pData);

    result = HMAC(EVP_sha256(), pKey, nkeyLen, (unsigned char*)pData, dataLen, NULL, NULL);

    return base64_encode(result, len);
}