We Keep Coding

Different results when signing same data with same keys in DSA cryptoservice provider

I am trying to build a small program that can discover whether file/files has been accessed or modified using DSA Signing algorithm.
I will give you this small example code to describe the issue.
Suppose that we have a file c:\Temporary\Temp.txt.
We have in our program 2 buttons. When we click the first button we create a digital signature
on the name of the file and the last access time on it. We also export the parameters and save them. On the second button click we recreate the signature on the same file using the parameters that we exported earlier and compare the new signature with the previous.
The problem here is that the program (always) gives me a result that the file has been accessed!!!!
I used the debugger to find the problem and saw that all variable values are identical between the 2 button_click events and that the difference occurs in the signing process.
Would you please tell me where the problem is?
Here is the code:
using System;
using System.Collections;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Linq;
using System.Text;
using System.IO;
using System.Threading.Tasks;
using System.Windows.Forms;
using System.Data.SqlClient;
using System.Security.Cryptography;
namespace WindowsFormsApplication1
{
public partial class Form1 : Form
{
string filename = #"C:\Temporary\Temp.txt";
DSAParameters parameters;
byte[] data_to_sign, signature;
public Form1()
{
InitializeComponent();
}
private void Form1_Load(object sender, EventArgs e)
{
}
private void Sign_button_Click(object sender, EventArgs e)
{
FileInfo f_info = new FileInfo(filename);
string file_information = f_info.FullName + f_info.LastAccessTime;
UnicodeEncoding byteEncoder = new UnicodeEncoding();
data_to_sign = byteEncoder.GetBytes(file_information);
DSACryptoServiceProvider dsaprovider = new DSACryptoServiceProvider();
parameters = dsaprovider.ExportParameters(true);
signature = dsaprovider.SignData(data_to_sign);
label1.Text = " Signature generated";
}
private void Verify_button_Click(object sender, EventArgs e)
{
FileInfo f_info = new FileInfo(filename);
string file_information = f_info.FullName + f_info.LastAccessTime;
UnicodeEncoding byteEncoder = new UnicodeEncoding();
data_to_sign = byteEncoder.GetBytes(file_information);
DSACryptoServiceProvider dsaprovider2 = new DSACryptoServiceProvider();
dsaprovider2.ImportParameters(parameters);
byte [] signature2 = dsaprovider2.SignData(data_to_sign);
if (signature == signature2)
label1.Text = "The file hasn't been accessed";
else
label1.Text = "Opp... The file has been accessed";
}
}
}

You are comparing two byte arrays using the == operator. You are comparing them by reference and this is always false for two different byte array instances, even if their contents are the same. You need to compare their contents instead.
Use the various code pieces from this question to actually compare the contents.
Instead of
if (signature == signature2)
you can do something like:
if (signature.SequenceEqual(signature2))
If you have System.Linq in your using declarations.

You completely missuse DSA. DSA is a signature algorithm, that you need to verify using a digital signature verification algorithm. In fact DSA is designed to produce a different signature on every use, because it depends on random numbers to generate it.
What you want here is an Hash algorithm, like SHA-256 or Keccak.

You're using
string file_information = f_info.FullName + f_info.LastAccessTime;
as the basis for the deciion, which means you rely on the fact that the file name and last access time did not change.
You don't know what the .NET framework does internally when
creating an object of type FileInfo. Maybe that already accesses the
file. Or it accesses the file when using the FullName property.
You should also call Refresh() when accessing the properties of the same file again. Otherwise it may use cached information.
The LastAccessTime is not very reliable. For performance reasons,
Windows 7 does not update that flag. Read "Windows
Internals 6" for details.
Why are you using DSA at all in this
example? You could simply compare the file_information strings
directly. Signing or not would not make the difference.
Like
Sebastian said, compare byte[] for equality correctly

compressing a string in C# and uncompressing in python

I am trying to compress a large string on a client program in C# (.net 4) and send it to a server (django, python 2.7) using a PUT request.
Ideally I want to use the standard library at both ends, so I am trying to use gzip.
My C# code is:
public static string Compress(string s) {
var bytes = Encoding.Unicode.GetBytes(s);
using (var msi = new MemoryStream(bytes))
using (var mso = new MemoryStream()) {
using (var gs = new GZipStream(mso, CompressionMode.Compress)) {
msi.CopyTo(gs);
}
return Convert.ToBase64String(mso.ToArray());
}
}
The python code is:
s = base64.standard_b64decode(request)
buff = cStringIO.StringIO(s)
with gzip.GzipFile(fileobj=buff) as gz:
decompressed_data = gz.read()
It's almost working, but the output is: {▯"▯c▯h▯a▯n▯g▯e▯d▯"▯} when it should be {"changed"}, i.e. every other letter is something weird.
If I take out every other character by doing decompressed_data[::2], then it works, but it's a bit of a hack, and clearly there is something else wrong.
I'm wondering if I need to base64 encode it at all for a PUT request? Is this only necessary for POST?

I think the main problem might be C# uses UTF-16 encoded strings. This may yield a problem similar to yours. As any other encoding problem, we might need a little luck here but I guess you can solve this by doing:
decompressed_data = gz.read().decode('utf-16')
There, decompressed_data should be Unicode and you can treat it as such for further work.
UPDATE: This worked for me:
C Sharp
static void Main(string[] args)
{
FileStream f = new FileStream("test", FileMode.CreateNew);
using (StreamWriter w = new StreamWriter(f))
{
w.Write(Compress("hello"));
}
}
public static string Compress(string s)
{
var bytes = Encoding.Unicode.GetBytes(s);
using (var msi = new MemoryStream(bytes))
using (var mso = new MemoryStream())
{
using (var gs = new GZipStream(mso, CompressionMode.Compress))
{
msi.CopyTo(gs);
}
return Convert.ToBase64String(mso.ToArray());
}
}
Python
import base64
import cStringIO
import gzip
f = open('test','rb')
s = base64.standard_b64decode(f.read())
buff = cStringIO.StringIO(s)
with gzip.GzipFile(fileobj=buff) as gz:
decompressed_data = gz.read()
print decompressed_data.decode('utf-16')
Without decode('utf-16) it printed in the console:
>>>h e l l o
with it it did well:
>>>hello
Good luck, hope this helps!

It's almost working, but the output is: {▯"▯c▯h▯a▯n▯g▯e▯d▯"▯} when it should be {"changed"}
That's because you're using Encoding.Unicode to convert the string to bytes to start with.
If you can tell Python which encoding to use, you could do that - otherwise you need to use an encoding on the C# side which matches what Python expects.
If you can specify it on both sides, I'd suggest using UTF-8 rather than UTF-16. Even though you're compressing, it wouldn't hurt to make the data half the size (in many cases) to start with :)
I'm also somewhat suspicious of this line:
buff = cStringIO.StringIO(s)
s really isn't text data - it's compressed binary data, and should be treated as such. It may be okay - it's just worth checking whether there's a better way.

Trying to hash a password

Note: I will not be using salts. Thanks for your advice though!
I'm testing how to hash a password using SHA1 and can't seem to wrap my head around it. My database column is Password char(40) not null.
Here's my code:
using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.IO;
using System.Security.Cryptography;
namespace Consumer
{
class Program
{
static void Main(string[] args)
{
string password = "Mypassword";
byte[] data password.tobytearray()???
byte[] result;
SHA1 sha = new SHA1CryptoServiceProvider();
// This is one implementation of the abstract class SHA1.
result = sha.ComputeHash(data);
Console.WriteLine(result.ToString());
Console.ReadLine();
}
}
}

It sounds like you're trying to convert a string into a byte[]. This is done by using one of the Encoding classes.
byte[] data = System.Text.Encoding.Unicode.GetBytes(password);
byte[] data = System.Text.Encoding.ASCII.GetBytes(password);
I'm not sure which is most appropriate for your scenario but I would use Unicode unless I had a specific reason to do otherwise.

To convert a string to a Byte[], use the Encoding class.
Also, result is a Byte[], which doesn't override ToString().
To get a string representation of the byte array, you can call BitConverter.ToString or Convert.ToBase64String.
In a database, you should store the raw byte array directly.

So your correct program would be something like
static void Main(string[] args)
{
string password = "Mypassword";
byte[] data = System.Text.Encoding.ASCII.GetBytes(password);
//or byte[] data = System.Text.Encoding.Unicode.GetBytes(password);
byte[] result;
SHA1 sha = new SHA1CryptoServiceProvider();
// This is one implementation of the abstract class SHA1.
result = sha.ComputeHash(data);
Console.WriteLine(Convert.ToBase64String(result));
Console.ReadLine();
}

.NET: Reading/writing binary string

EDIT: Don't answer; I've found the solution on my own.
I have some code that does this:
using (var stream = new FileStream(args[1], FileMode.Create))
{
using (var writer = new BinaryWriter(stream))
{
writer.Write(ip.Iso3166CountryCode);
...
}
}
Iso3166CountryCode is a string with two characters ("US").
When I try to read "US" from the file:
// line is a byte[] from the file with the first 1024 bytes
UnicodeEncoding.Default.GetString(line.Take(2).ToArray());
I don't get "US" back, I get some odd ASCII characters back. How do I read the two country-code characters from this binary file?
EDIT: NEVER MIND. I changed writer.Write(ip.Iso3166CountryCode) to writer.Write(UnicodeEncoding.Default.GetBytes(ip.Iso3166CountryCode)) and it works.

Try changing writer.Write(ip.Iso3166CountryCode) to writer.Write(UnicodeEncoding.Default.GetBytes(ip.Iso3166CountryCode)), that should work! :)

Issue in writing special characters to Excel

I have a few reports that are exported to Excel. The problem is whereever there are special characters, it is being replaced by some funny symbols
For example, '-'(hyphen) was replaced by –...
Any help to solve the problem??

The most straight forward way is to encode the text file as UTF-8. I ran the following code, opened the resulting hyphen.txt file in Excel 2007 and it worked as expected:
using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
namespace ConsoleApplication1
{
class Program
{
static void Main(string[] args)
{
var hyphen = "\u2010\r\n";
var encoding = Encoding.UTF8;
var bytes = encoding.GetBytes(hyphen);
using (var stream = new System.IO.FileStream(#"c:\tmp\hyphen.txt", System.IO.FileMode.Create, System.IO.FileAccess.ReadWrite))
{
stream.Write(bytes, 0, bytes.Length);
}
}
}
}

This is the code -- view at PasteBin.