SHA-2 hashing with AutoIt

[Crash]

Dear AutoIt communities,

I wish to perform SHA-256 hashing with AutoIt. I noticed Help File shows the use of MD2, MD4, MD5, SHA1. To my knowledge, all of these aren't cryptographically secure anymore and SHA-2 (SHA-256, SHA-384, SHA-512) is the way to hash passwords.

I poked around Crypt.au3 and found SHA-2 constants are commented out. Why is this? I'm using latest public release, v 3.3.14.2

; #CONSTANTS# ===================================================================================================================
Global Const $PROV_RSA_FULL = 0x1
Global Const $PROV_RSA_AES = 24
Global Const $CRYPT_VERIFYCONTEXT = 0xF0000000
Global Const $HP_HASHSIZE = 0x0004
Global Const $HP_HASHVAL = 0x0002
Global Const $CRYPT_EXPORTABLE = 0x00000001
Global Const $CRYPT_USERDATA = 1

Global Const $CALG_MD2 = 0x00008001
Global Const $CALG_MD4 = 0x00008002
Global Const $CALG_MD5 = 0x00008003
Global Const $CALG_SHA1 = 0x00008004
; Global Const $CALG_SHA_256 = 0x0000800c
; Global Const $CALG_SHA_384 = 0x0000800d
; Global Const $CALG_SHA_512 = 0x0000800e
Global Const $CALG_3DES = 0x00006603
Global Const $CALG_AES_128 = 0x0000660e
Global Const $CALG_AES_192 = 0x0000660f
Global Const $CALG_AES_256 = 0x00006610
Global Const $CALG_DES = 0x00006601
Global Const $CALG_RC2 = 0x00006602
Global Const $CALG_RC4 = 0x00006801
Global Const $CALG_USERKEY = 0
Global Const $KP_ALGID = 0x00000007

 

I thought this could be compatibility issues, and older Windows doesn't support SHA-2.

Without knowing what I am doing, MSDN help appears to say SHA256 is available since Windows Platform 10 (https://msdn.microsoft.com/en-us/library/system.security.cryptography.sha256(v=vs.110).aspx) However other sources said SHA-2 has been supported since Win XP SP 3.

What is happening? How can I implement SHA-2 with confidence that it will work on Win XP? Unfortunately I do not have an older computer or virtual PC to test it out. I'm running latest Windows 10 and SHA-256, SHA-384, SHA-512 all works fine. (If you like to try on your machine, I've attached the help file hashing example with SHA-2 algo added)

 

Thank you yet again

Crash

sdfsdaf.au3

[BrewManNH]

It was decided that because the commented out algorithms weren't available in XP below SP3, they would be commented out but included in the file.

It's completely ok to uncomment them and use them in your scripts. Windows crypto API supports them in versions of Windows above XP SP3 and if you're running anything below SP3 on XP you deserve to get hacked.

[Crash]

It was decided that because the commented out algorithms weren't available in XP below SP3, they would be commented out but included in the file.

It's completely ok to uncomment them and use them in your scripts. Windows crypto API supports them in versions of Windows above XP SP3 and if you're running anything below SP3 on XP you deserve to get hacked.

haha Windows XP isn't supported now anyway so I think this lack of SHA-2 is the least of their concerns. Thanks for the confirmation!

[iamtheky]

Something about Dec. 23rd and remembering there is no good reason that those are commented out.  Looootttttssss of stuff doesnt work in XP.

Posted 23 Dec 2014 · Report post

Those constants are declared in the UDF and therefore don't need to be included at the top of your script.

https://www.autoitscript.com/forum/topic/166338-sha-256

 

[Crash]

Ahh thank you I forgot to search the forum before posting a new topic. I apologise.

I followed some links and MSDN confirmed that SHA-2 is not supported under XP SP3:

Windows XP with SP3:  This algorithm is supported by the Microsoft Enhanced RSA and AES Cryptographic Provider (Prototype).

Windows XP with SP2, Windows XP with SP1, and Windows XP:  This algorithm is not supported.

(This is going to be useful for other forum searcher)

 

My current implementation includes a fallback. I'm not a good programmer and this is not tested on XP, but here goes:

#include <Crypt.au3>

Const $algo = 0x0000800c ; SHA-256
Const $algofallback = $CALG_SHA1

$passwd = ...... ; typed by user
$salt = ...... ; generated with _Crypt_GenRandom

Local $hash = _Crypt_HashData($passwd & $salt, $algo)
If @error Then $hash = _Crypt_HashData($passwd & $salt, $algofallback) ; fall back

I hard coded SHA-256 code to improve compatibility when others compile my code, and uses @error to see if SHA-256 can be used. I hope that's secure  Any constructive criticisms welcomed!

Edited December 24, 2015 by Crash

[iamtheky]

there are many pieces in many UDFs that fail on XP.  A feature that is incompatible with XP is at most a note in the helpfile, and that is if you want to be really nice about it.  You certainly dont test the new features, then add the new features, and then comment them out because of reasons that dont hold back any other UDF, do you?

[Crash]

there are many pieces in many UDFs that fail on XP.  A feature that is incompatible with XP is at most a note in the helpfile, and that is if you want to be really nice about it.  You certainly dont test the new features, then add the new features, and then comment them out because of reasons that dont hold back any other UDF, do you?

Haha I certainly don't know how I feel about this. I think it's nice for beginners like me who don't quite know our ways around. It would be quite frustrating if a function doesn't work. But I agree that in this particular case the constants shouldn't be commented out but instead only be warned in the help files.

Recently a big head scratching moment for me when I tried to change the text colour on checkboxes. Although it is noted that GUICtrlSetColor wouldn't work on checkboxes with XP theme, I'm on Win 10 as far as I'm concerned. It took a long time to figure that that the "XP theme" is at fault and I should strip the theme first. These little moments made me wanna shout at my screen.

Oh I hope AutoIt admins are reading this; I hope they will implement Windows 10 custom colour changing title bar. Or the task bar item acting as progress bar. Or Windows 10 notification centre.

[iamtheky]

That would be the too new end of the spectrum, imo (very late at night).   I have a mixture of 7.1 and 8.1 endpoint systems, and they play great.  Why not just stay with the herd and play the same game as everyone else?  Let the devs get there first and wait for the ok to move forward.    *Right, that game sux.  I went to 10 for the new powershell stuff, but I just jump to that box and run cli.  

I'd like to see the script that cannot set control color, I am not having issue with the examples from the helpfile on win 10 

Edited December 24, 2015 by iamtheky

[Crash]

#include <GUIConstantsEx.au3>

$GUI = GUICreate("Test", 200, 300)
GUISetBkColor(0x000000) ; black GUI

GUICtrlSetDefBkColor(0x000000) ; black bg controls
GUICtrlSetDefColor(0xFFFFFF) ; white text controls

$chk1 = GUICtrlCreateCheckbox("You can't see me", 25, 50)
$chk2 = GUICtrlCreateCheckbox("You saw me", 25, 100)

; strip XP theme
DllCall("UxTheme.dll", "int", "SetWindowTheme", "hwnd", GUICtrlGetHandle($chk2), "wstr", 0, "wstr", 0)

; gui stuff
GUISetState()
Do
    $msg = GUIGetMsg()
Until $msg = $GUI_EVENT_CLOSE

Here you go I couldn't have came up with the theme stripping code myself. Good thing I found that in forum

The white dotted border below is just Windows showing that control is active. The key here is that the text is not recoloured by GUICtrlSetColor (or in my case, GUICtrlSetDefColor)

Remarks from GUICtrlSetColor help:

Remarks

Only Button, Label, Checkbox, Group, Radio, Edit, Input, List, Listview, ListviewItem, Treeview, TreeviewItem, Graphic, Progress and Combo controls can currently be colored.

Checkbox, Radio, Group or Progress controls cannot be painted if the "Windows XP/Vista style" is used.

Button controls are always painted in "Windows Classic style".

If anyone could actually contribute to the help file, it'd be great to add in the strippnig code. It isn't very obvious to a beginner like me.

Edited December 24, 2015 by Crash

[BrewManNH]

Here you go I couldn't have came up with the theme stripping code myself. Good thing I found that in forum

The white dotted border below is just Windows showing that control is active. The key here is that the text is not recoloured by GUICtrlSetColor (or in my case, GUICtrlSetDefColor)

 

Remarks from GUICtrlSetColor help:

If anyone could actually contribute to the help file, it'd be great to add in the strippnig code. It isn't very obvious to a beginner like me.

_WinAPI_SetWindowTheme will do the same thing and it's in AutoIt already.

[Crash]

_WinAPI_SetWindowTheme will do the same thing and it's in AutoIt already.

Thank you. I got it working with

#include <GUIConstantsEx.au3>
#include <WinAPITheme.au3>

$GUI = GUICreate("Test", 200, 300)
GUISetBkColor(0x000000) ; black GUI

GUICtrlSetDefBkColor(0x000000) ; black bg controls
GUICtrlSetDefColor(0xFFFFFF) ; white text controls

$chk1 = GUICtrlCreateCheckbox("You can't see me", 25, 50)
$chk2 = GUICtrlCreateCheckbox("You saw me", 25, 100)

; strip XP theme
;DllCall("UxTheme.dll", "int", "SetWindowTheme", "hwnd", GUICtrlGetHandle($chk2), "wstr", 0, "wstr", 0)
_WinAPI_SetWindowTheme(GUICtrlGetHandle($chk2), 0, "")

; gui stuff
GUISetState()
Do
Until GUIGetMsg() = $GUI_EVENT_CLOSE