Generating bitcoin core -rpcauth argument using golang

Question

We're developing a Blockchain deployment solution kotal, and generating -rpcauth argument from the supplied user name and password. The problem is when we try to use the same user and password using curl, it writes ThreadRPCServer incorrect password attempt from 127.0.0.1:55566.

Here's how we're generating -rpcauth from password in golang.

user := "kotal"
password = "s3cr3t"

salt := make([]byte, 16)
rand.Read(salt)

hash := hmac.New(sha256.New, salt)
hash.Write([]byte(password))

rpcauth := fmt.Sprintf("%s:%x$%x", user, salt, hash.Sum(nil))

What's wrong with our golang implementation ?

Answer 1

The issue is that your salt is a byte array, which you are passing directly as the hmac key, and then printing out the hex. This would require bitcoind to interpret the salt hex as a hex string and convert it to the bytes represented by the hex. However that is not what bitcoind does.

Bitcoind takes the salt as is, and uses it directly has the hmac key. So you need to do the same thing - convert the byte array to a string, and use the bytes of that string as the key.

This code works:

user := "kotal"
password := "s3cr3t"

salt_data := make([]byte, 16)
rand.Read(salt_data)

salt := hex.EncodeToString(salt_data)

hash := hmac.New(sha256.New, []byte(salt))
hash.Write([]byte(password))

rpcauth := fmt.Sprintf("%s:%s$%x", user, salt, hash.Sum(nil))

Answer 2

You could use or take inspiration from the rpcauth script in the Bitcoin Core repository that does exactly this, but in Python.