tiny.reticulum.crypto.hmac

1const std = @import("std");23const HmacSha256 = std.crypto.auth.hmac.sha2.HmacSha256;45pub const tag_length: u8 = HmacSha256.mac_length;67/// An HMAC-SHA256 state that takes its input in pieces and then gives the8/// 32-byte tag. The key derivation feeds three pieces into one of these for9/// every output block, so it needs no buffer holding them together.10pub const Signer = struct {11    state: HmacSha256,1213    pub fn init(key: []const u8) Signer {14        return .{ .state = HmacSha256.init(key) };15    }1617    pub fn update(self: *Signer, data: []const u8) void {18        self.state.update(data);19    }2021    pub fn final(self: *Signer) [tag_length]u8 {22        var tag: [tag_length]u8 = undefined;23        self.state.final(&tag);24        return tag;25    }26};2728/// Returns the 32-byte HMAC-SHA256 tag of some data under a key, following29/// Reticulum@1.5.0 RNS/Cryptography/HMAC.py:27-45.30pub fn sign(key: []const u8, data: []const u8) [tag_length]u8 {31    var signer = Signer.init(key);32    signer.update(data);33    return signer.final();34}3536/// Returns whether a tag matches the one the key and data give, following37/// Reticulum@1.5.0 RNS/Cryptography/HMAC.py:185-188. The comparison takes the38/// same time whatever the bytes are, so a failure says nothing about how far39/// the tag matched.40pub fn verify(key: []const u8, data: []const u8, tag: [tag_length]u8) bool {41    const expected = sign(key, data);42    return std.crypto.timing_safe.eql([tag_length]u8, expected, tag);43}

1pub const hmac = @import("hmac.zig");