title: Generate a keyed hash value using the HMAC method with Google Apps Script
body: <p>Is there a way to create a hash value in Google Apps Script?  Google Apps Script will run server side code in the <code>.gs</code> code file.  The <code>.gs</code> file is written in JavaScript.  Because JavaScript is mostly a client side language, and encrypting anything client side isn't secure, maybe something like HMAC for Javascript isn't available?  When I do a web search on <code>hmac in javascript</code> the first thing I get is <code>crypto-js</code>.  But it looks like I need to link to some services in <code>&lt;script&gt;</code> tags:</p>
  
  <pre><code>&lt;script src="http://crypto-js.googlecode.com/svn/tags/3.1.2/build/rollups/hmac-md5.js"&gt;&lt;/script&gt;
  &lt;script src="http://crypto-js.googlecode.com/svn/tags/3.1.2/build/rollups/hmac-sha1.js"&gt;&lt;/script&gt;
  &lt;script src="http://crypto-js.googlecode.com/svn/tags/3.1.2/build/rollups/hmac-sha256.js"&gt;&lt;/script&gt;
  &lt;script src="http://crypto-js.googlecode.com/svn/tags/3.1.2/build/rollups/hmac-sha512.js"&gt;&lt;/script&gt;
  &lt;script&gt;
      var hash = CryptoJS.HmacMD5("Message", "Secret Passphrase");
      var hash = CryptoJS.HmacSHA1("Message", "Secret Passphrase");
      var hash = CryptoJS.HmacSHA256("Message", "Secret Passphrase");
      var hash = CryptoJS.HmacSHA512("Message", "Secret Passphrase");
  &lt;/script&gt;
  </code></pre>
  
  <p>The <code>Secret Passphrase</code> would be in your client side HTML.  That doesn't make any sense!  Oh!  I just found some pseudocode in wikipedia.</p>
  
  <p><a href="http://en.wikipedia.org/wiki/Hash-based_message_authentication_code#Implementation" rel="nofollow">Wikipedia HMAC pseudo Code</a></p>
  
  <p>Here is my attempt at refactoring it:</p>
  
  <pre><code>//blocksize is the size in bytes and is set to 64 bytes.
  //byte size of any UTF-8 string
  
  function byteCount(s) {
    return encodeURI(s).split(/%..|./).length - 1;
  };
  
  function hmac(key, message) {
      var blocksize = 64;
      var keyLngth = byteCount(key);
  
      if (keyLngth &gt; blocksize) {
          key = hash(key); // keys longer than blocksize are shortened
      }
      else if (keyLngth &lt; blocksize) {
          key = key + [0x00 * (blocksize - keyLngth)]; // keys shorter than blocksize are zero-padded 
      };
  
      var o_key_pad = [0x5c * blocksize] ⊕ key; // Where blocksize is that of the underlying hash function
      var i_key_pad = [0x36 * blocksize] ⊕ key; // Where ⊕ is exclusive or (XOR)
  
      return hash(o_key_pad + hash(i_key_pad + message));
  };
  </code></pre>
  
  <p>I guess wherever the pseudo Code states: <code>hash(key)</code> one of the following hash functions: SHA-1, MD5, RIPEMD-128/160 needs to be used.</p>
  
  <p>So I did a search on SHA-1 in JavaScript and found this:</p>
  
  <p><a href="http://www.movable-type.co.uk/scripts/sha1.html#code" rel="nofollow">http://www.movable-type.co.uk</a></p>
  
  <p>Any info on how to create a HMAC value using Javascript would be greatly appreciated.  I'll probably keep working on it, in the meantime.  Even though it's Javascript, it's a Google <code>.gs</code> Apps Script code file, which runs on the server.</p>