I am looking to implement HMACSHA256 encoding in Excel VBA.

Several examples/answers make use of System.Text.UTF8Encoding & System.Security.Cryptography.HMACSHA256 however I'm using Windows 10/Office 365 which results in an automation error due to the .NET 4.6 framework (per this stackoverflow post).

There does appear to be an existing VB6 implementation, however it makes use of various Windows libraries which I'd rather avoid as my code may need to run on Office for Mac. I'm also interested in implementing this from first principles as a learning experience.

Per the comment on this page I decide to write my own HMAC wrapper on top of an existing SHA256 class module.

Using the spec and pseudocode in the comment I came up with the below code which I added to the SHA256 class module.

Please Login or Register  to view this content.
SHA256 is the main function defined in the class module

When I call the function it returns a correctly formatted but incorrect HMACSHA256 digest.

Please Login or Register  to view this content.
digest output:

HMAC_SHA256: 1fa93aea23d7b353ef468e5ac460b2840c694842e7ac2018d58a7bf5b790b6e3
SHA256: b381e7fec653fc3ab9b178272366b8ac87fed8d31cb25ed1d0e1f3318644c89c

the SHA256 digest is correct, I've verified it against the test vectors in the spec and with online generators. however the HMAC256 digest is incorrect, it should be...

5bdcc146bf60754e6a042426089575c75a003f089d2739839dec58b964ec3843

There is not much happening in the function so I can't figure out where this is going wrong. The string/byte conversions seem to be the likely candidate; I have experimented with various options for doing the conversion...

Please Login or Register  to view this content.
I tried using the various different options with the function and all resulted in an incorrect digest. As I understand it HMAC_SHA256 works with UTF8 byte arrays, and that appears to be what my current function is doing so am at a loss as what the error could be.

Does anyone have any ideas where I might be going wrong? Or know of any resource/method where I could determine the correct UTF8 byte array for a known key value and also the correct post-Xor-operation byte array & string value for iPad & oPad. This would allow me to compare with my function at various steps along the way to help track down the problem.

Thanks

~a