Hi all,

the customer gives me a daily xml file with approved users and paswords. Passwords are MD5 hashed, so passwords remain secret.

I made a script with the Xstandard.MD5 object and pass the entered password string (input from operator) to this object and I get the hashed password back, which me script compares with the hash in the received xml file.

This works, I checked my hashed passwords with online encryption tools and I get the same result, So far so good...

When I got example passwords and xml file from the customer, it doesn't work at all. Their hashes are completely different and do not match online encryption tools and my code...

I received their VB code how they encrypt the passwords and this is the code:

*****************************************************

Normal 0 21 false false false NL-BE X-NONE X-NONE MicrosoftInternetExplorer4

    Private Function CalculateMD5Hash(ByVal password As String) As String

        Dim encoder As Encoder

        Dim unicodeText() As Byte

        Dim md5 As MD5CryptoServiceProvider

        Dim result() As Byte

        Dim builder As StringBuilder

        ' First we need to convert the string into bytes, which

        ' means using a text encoder.

        encoder = System.Text.Encoding.Unicode.GetEncoder()

        ' Create a buffer large enough to hold the string

        ReDim unicodeText(password.Length * 2)

        encoder.GetBytes(password.ToCharArray(), 0, password.Length, unicodeText, 0, True)

        ' Now that we have a byte array we can ask the CSP to hash it

        md5 = New MD5CryptoServiceProvider()

        result = md5.ComputeHash(unicodeText)

        ' Build the final string by converting each byte

        ' into hex and appending it to a StringBuilder

        builder = New StringBuilder()

        For i As Integer = 0 To result.Length - 1

            builder.Append(result(i).ToString("X2"))

        Next

        ' And return it

        Return builder.ToString()

    End Function

*****************************************************

I assume that the difference in hashes is due to the password.toCharArray() function, but how do I translate this code to the TIA scripting?

THX for any suggestions or solutions :)

Hello,

what is encoding system implemented in your script? In their script is Unicode, really don't know why, because maybe default is enough, simply creating buffer of Bytes. Can you ask their programmer about it? I just think why you have different results.

I've putted the version in the title, RT advanced, TIA V13 SP1 Upd5, on a Windows 7 IPC.

Abouth the Vb code from the client, my thought is also the conversion of the string that causes the difference, I asked the customer why they do that, but no answer yet received (they probably copied the code from internet I suppose...)

Is it possible in TIA to do the same conversion of the string?

Hello,

probably nothing exists like that .NET library classes in TIA. Really don't see reason for implementing Cryptography in PLC like this. Other side is using scripting in OPs. In this case some experts of this maybe can help to you with some implementation.

Edit: sry question, what is your Xstandard MD5 object? Pls reply for understanding.

Xstandard.MD5 is a free dll which does the MD5 encryption for me, i just do a creatObject to this dll and call the method for encryption. It returns the hash to me, which I can then compare to the hashes in the xml file.

(code is run in the runtime, not in the PLC)

I know that this stuff is overkill, but it's the customer who wants this and I'm the lucky guy who's job it is to implement this...

aaaaaah I understand (free DLL), thnx for info. What about asking suplier to implement this DLL without that their .NET framework class? Then everything will work correctly  In my opinion there can't be problem with this, encryption will be implemented on both sides. Consider it.

Edit: Think same as Murof said, if there can be installed proper .NET framework, that suplayer script can probably work.

Bounced this back to the customer that they should do a proper MD5 hash calculation, didn't hear from them since...

Thx for the suggestions everybody

Hello,

thnx for info. Pls be kind tell us some news, how it will close.

The customer will make a DLL, which will do the MD5 hash in their way and not the standard one.

As soon as I receive this and it works: problem solved :)