Question

I’m trying to decrypt a file. First 2 steps:

Copy the first 16 bytes of the file to a buffer. This is the HMAC-SHA1 hash of the file which is made using one of the keys above.

Use HMAC-SHA1 on that buffer with a key from above to create the RC4 key, which is 0x10 bytes.

My code is:

OpenFileDialog ofd = new OpenFileDialog();
        ofd.ShowDialog();
        BinaryReader binread = new BinaryReader(File.Open(ofd.FileName, FileMode.Open));
        byte[] RetailKey = { 0xE1, 0xBC, 0x15, 0x9C, 0x73, 0xB1, 0xEA, 0xE9, 0xAB, 0x31, 0x70, 0xF3, 0xAD, 0x47, 0xEB, 0xF3 };
        HMACSHA1 SHA = new HMACSHA1(RetailKey); //Initalize HMAC w/ retail or development key
        byte[] buffer = binread.ReadBytes(16);
        buffer = SHA.ComputeHash(buffer);
        MessageBox.Show(buffer.Length.ToString());    

As you can see, it says buffer has to be 10 bytes but messagebox says it is 20 bytes.Where is my mistake?

Answer 1

SHA-1 and thus HMAC-SHA-1 outputs 20 bytes.

You only need 16 (0x10) of them so you need to truncate. For example with byte[] key = hmacSha1.ComputeHash(input).Take(16).ToArray().

The 0x in 0x10 is a prefix denoting hexadecimal numbers in c (and derived languages). So 0x10 means 16 and not 10.