Accertify Hash Algorithm

2 min

Use the Accertify Hash Algorithm to hash specific sensitive fields before submitting them to Accertify APIs. This algorithm applies to Universal Fraud APIs and any other Accertify APIs that designate a field as hash-required.

When to Use This Algorithm

Hash the clear-text value prior to sending it to the API for fields that require hashing. The API Reference explicitly identifies hash‑required fields. Common examples include:

giftCardNumber

hashedPassword

If a field requires hashing and you submit a value that appears to be plain text, the API may reject the request.

Given an input string S (the clear-text value), compute the hash as follows:

Encode S to bytes using UTF‑8.

Compute byteKey = SHA-256(S_bytes) (a 32-byte digest).

Compute hmac = HMAC-SHA256(key=byteKey, message=S_bytes).

Return Base64Encode(hmac) using URL-safe Base64 (per the Java implementation).

If the input is blank/empty, return an empty string.

Why This Looks Unusual

This algorithm uses a derived key (SHA-256(input)) and then HMACs the original input using that derived key. That is intentional and must be followed exactly to match platform expectations.

Java Reference Implementation

C# Reference Implementation

public static String hash(String rawSearchValue) {
    Base64 base64 = new Base64(Integer.MAX_VALUE, new byte[]{}, true);
    MessageDigest sha256;
    Mac hmacSha256;
    try {
        sha256 = MessageDigest.getInstance("SHA-256");
        hmacSha256 = Mac.getInstance("HMACSHA256");
    } catch (NoSuchAlgorithmException e) {
        throw new RuntimeException(e.getMessage(), e);
    }

    if (StringUtils.isNotBlank(rawSearchValue)) {
        try {
            byte[] value = rawSearchValue.getBytes(UTF_8);
            sha256.reset();
            byte[] byteKey = sha256.digest(value);
            hmacSha256.init(new SecretKeySpec(byteKey, "SHA-256"));
            return base64.encodeAsString(hmacSha256.doFinal(value));
        } catch (InvalidKeyException ex) {
            throw new RuntimeException("Invalid key, error: " + ex.getMessage(), ex);
        }
    }

    return StringUtils.EMPTY;
}

Important notes:

Uses UTF‑8 input bytes.

Uses Base64(..., urlSafe=true) → URL-safe Base64 encoding.

Returns empty string for blank input.

using System;
using System.Security.Cryptography;
using System.Text;

public class AccertifyHashTester
{
    private static string Hash(String inputValue)
    {
        Byte[] hmacHash;
        using (SHA256 shaHash = SHA256.Create()) {
            Encoding enc = Encoding.UTF8;
            Byte[] byteKey = shaHash.ComputeHash(enc.GetBytes(inputValue));
            var hmacInstance = new HMACSHA256(byteKey);
            hmacHash = hmacInstance.ComputeHash(GetBytesFromString(inputValue));
        }
        return System.Convert.ToBase64String(hmacHash);
    }

    private static byte[] GetBytesFromString(string text)
    {
        var encoding = new System.Text.UTF8Encoding();
        return encoding.GetBytes(text);
    }

    public static void Main(string[] args)
    {
        Console.WriteLine(Hash(args[0]));
    }
}

Encoding requirement:

The Accertify Hash Algorithm requires URL‑safe Base64 encoding of the HMAC output. Implementations must use URL‑safe Base64 encoding (RFC 4648, §5) to produce valid hashes.

Note on C# implementation:

The C# example uses standard Base64 encoding as written. If your integration requires URL‑safe Base64 output, you must transform the encoded value accordingly (for example, replacing + with -, / with _, and removing padding characters).

Accertify Hash Algorithm

Topic Intent

When to Use This Algorithm

High-Level Algorithm (normative)

Why This Looks Unusual

Full Algorithm (Java and C#)

Accertify Hash Algorithm

﻿﻿﻿Topic Intent﻿﻿﻿

When to Use This Algorithm

High-Level Algorithm (normative)

Why This Looks Unusual

Full Algorithm (Java and C#)

Topic Intent