ShowUpShot - .NET COM interop spike

Confirms which cryptographic and helper components are creatable via Server.CreateObject on this host. Delete this file before public launch.

Component availability

Component	ProgID	Result
UTF-8 encoding	`System.Text.UTF8Encoding`	OK
ASCII encoding	`System.Text.ASCIIEncoding`	OK
SHA-256 managed	`System.Security.Cryptography.SHA256Managed`	OK
HMAC-SHA-256	`System.Security.Cryptography.HMACSHA256`	OK
Secure RNG	`System.Security.Cryptography.RNGCryptoServiceProvider`	OK
PBKDF2 (Rfc2898)	`System.Security.Cryptography.Rfc2898DeriveBytes`	FAIL err -2147221005: 006~ASP 0177~Server.CreateObject Failed~800401f3
Password derive bytes	`System.Security.Cryptography.PasswordDeriveBytes`	FAIL err -2147221005: 006~ASP 0177~Server.CreateObject Failed~800401f3
MSXML2.ServerXMLHTTP.6.0	`MSXML2.ServerXMLHTTP.6.0`	OK
ADODB.Stream	`ADODB.Stream`	OK
CDO.Message	`CDO.Message`	OK
Scripting.FileSystemObject	`Scripting.FileSystemObject`	OK

HMAC-SHA-256 end-to-end test

Computes HMAC-SHA256(key="secret", msg="hello") and verifies the digest is 32 bytes. Copy the hex and verify against any online HMAC calculator to confirm the value.

Result: OK - digest length 32 bytes: 88aab3ede8d3adf94d26ab90d3bafd4a2083070c3bcce9c014ee04a443847c0b [VarType=8209 IsArray=True]

Expected value: 88aab3ede8d3adf94d26ab90d3bafd4a2083070c3bcce9c014ee04a443847c0b (from a reference implementation; treat as informational).

Interpreting the result

If HMAC end-to-end is OK, Stripe webhook signature verification will work in pure VBScript. Proceed with Phase 1 as planned.
If PBKDF2 (Rfc2898) shows OK, set HASH_ALGO="pbkdf2-sha256-v1" in includes/config.asp and switch includes/hash.asp to the PBKDF2 path.
If PBKDF2 is FAIL but SHA-256 Managed is OK, the fallback path in includes/hash.asp works but is weaker. File a follow-up to register a custom .NET DLL exposing PBKDF2 or bcrypt before public launch.
If HMAC-SHA-256 is FAIL, do not proceed with Stripe integration until a custom DLL is registered. Escalate the host limitation.