title: HMAC Algorithm (SHA256) in Classic ASP VBScript
body: <p>I'm trying to write an HMAC function in Classic ASP using SHA256 as the hash. I thought I got it right, but the results aren't the same for the examples listed on the <a href="https://en.wikipedia.org/wiki/Hash-based_message_authentication_code" rel="nofollow noreferrer">Wikipedia page</a>. I've seen several examples of people using HMAC SHA256 in Classic ASP by including a WSC. This is not what I want to do. </p>
  
  <p>Here's the function:</p>
  
  <pre class="lang-vb prettyprint-override"><code>Public Function HMAC_SHA256(prmKey, prmData)
      Dim theKey : theKey = prmKey
      Dim Block_Size, O_Pad, I_Pad
      Block_Size = 64
      O_Pad = 92 'HEX: 5c'
      I_Pad = 54 'HEX: 36'
  
      Dim iter, iter2
      If Len(theKey) &lt; Block_Size Then
          For iter = 1 to Block_Size - Len(theKey)
              theKey = theKey &amp; chr(0)
          Next
      ElseIf Len(theKey) &gt; Block_Size Then
          theKey = SHA256(theKey)
      End If
  
      Dim o_key_pad : o_key_pad = ""
      Dim i_key_pad : i_key_pad = ""
      For iter = 1 to Block_Size
          o_key_pad = o_key_pad &amp; Chr(Asc(Mid(theKey,iter,1)) xor O_Pad)
          i_key_pad = i_key_pad &amp; Chr(Asc(Mid(theKey,iter,1)) xor I_Pad)
      Next
  
      HMAC_SHA256 = SHA256(o_key_pad &amp; SHA256(i_key_pad &amp; prmData))
  End Function
  </code></pre>
  
  <p>And here's the pseudocode from Wikipedia's HMAC:</p>
  
  <pre><code>function hmac (key, message)
      if (length(key) &gt; blocksize) then
          key = hash(key) // keys longer than blocksize are shortened
      end if
      if (length(key) &lt; blocksize) then
          key = key ∥ [0x00 * (blocksize - length(key))] // keys shorter than blocksize are zero-padded (where ∥ is concatenation)
      end if
  
      o_key_pad = [0x5c * blocksize] ⊕ key // Where blocksize is that of the underlying hash function
      i_key_pad = [0x36 * blocksize] ⊕ key // Where ⊕ is exclusive or (XOR)
  
      return hash(o_key_pad ∥ hash(i_key_pad ∥ message)) // Where ∥ is concatenation
  end function
  </code></pre>
  
  <p>I can't for the life of me determine what's wrong here. I imagine someone's going to tell me it's impossible in ASP and that's why there are so many suggestions to use the WSC. If this is the case, can someone explain why it's impossible? I don't see anything that should make this impossible.</p>
  
  <p>Thanks!</p>
  
  <p>EDIT: I've made sure the SHA256 function I use is giving the correct hashes, so it's nothing to do with that. I've also tried UCase'ing the results of the SHA256 function, and no dice.</p>
  
  <p>EDIT2: Added example from wiki page.</p>