Message Signing And Verification

MQL4 ships with no cryptographic hash function of any kind, so there is no library to wrap here - a real HMAC needs a real hash underneath it, which means implementing one from scratch. This header hand-writes MD5 (RFC 1321) directly, including its per-round constant table, and builds a genuine HMAC construction (RFC 2104) on top of it: HmacMd5Hex(key, message) computes MD5(opad XOR key || MD5(ipad XOR key || message)), exactly as specified, not a simplified or partial version of it. The 64-entry K constant table is computed at runtime from its own mathematical definition (floor(|sin(i+1)| * 2^32)) rather than transcribed as 64 hard-coded hex literals - the single most realistic way a hand-written hash implementation silently produces wrong output is one mistyped constant in a table like that, and computing it removes that risk entirely rather than trying to proofread it away. Read this honestly before relying on it: HMAC-MD5 is a genuine keyed message-authentication code, and it has NOT been practically broken as an authentication mechanism, unlike plain MD5 hashing, whose known collision attacks (finding two different messages with the same hash) have no bearing on HMAC's keyed-forgery resistance - collision resistance and MAC security are different properties. What this library cannot give you, no matter how correct the algorithm is, is secure key storage: MQL4 has nowhere to keep a secret except a plain input parameter or a plain-text file, both readable by anything with file-system access to the terminal, and there is no built-in cryptographically secure random source for generating that key in the first place. Use this to confirm a command file or webhook payload genuinely came from your own tooling and was not altered in transit or on disk - a real, useful guarantee against accidental corruption and casual tampering - not as a claim of bank-grade security against an attacker who already has access to the machine the key lives on. Notes and limitations - MD5's 128-bit digest is smaller than a modern hash function's, and MD5 itself (unkeyed) is broken for collision resistance. This library exists because MQL4 has no alternative built in - if a stronger primitive is ever exposed by the platform, prefer it. HMAC-MD5 specifically remains reasonable for the "did my own tooling produce this file" use case this library targets, not for defending against a well-resourced adversary. - No secure key storage exists on this platform. Treat any key held in an input parameter or a file as visible to anyone with file-system access. - VerifyHmacMd5 compares every character rather than stopping at the first mismatch, avoiding the most obvious timing signal - a defence-in-depth habit, not a claim that MQL4's interpreter gives genuinely constant-time execution regardless. - SignFileContents/VerifyFileContents read the file as FILE_TXT lines and rejoin them with "\n" - this normalises whatever line-ending convention the file was saved with, so signing is stable across platforms, but it also means the signature is over the rejoined text, not the file's exact original bytes. - This library signs and verifies; it does not handle key exchange, key rotation, or replay protection - a command file with a valid old signature can be replayed unless the caller adds its own nonce or timestamp field to the signed content and checks it separately.

Script · MT4 · v1.0 · Free

Tags: Bitcoin & Crypto · MT4 Script · MQL4 Source Code

MQL4 & MQL5 scripts · PolyMaria