hmac

nimony/lib/std/crypto/hmac.nim

HMAC (RFC 2104) and HKDF (RFC 5869) over SHA-256 and SHA-384.

HKDF is the whole of TLS 1.3's key schedule; std/tls builds its HKDF-Expand-Label on hkdfExpand here.

type HmacSha256 = object
  inner: Sha256
  outer: Sha256

type HmacSha384 = object
  inner: Sha512
  outer: Sha512

func initHmacSha256(key: openArray[uint8]): HmacSha256
func update(h: var HmacSha256; data: openArray[uint8])
func finish(h: HmacSha256): array[0..31, uint8]
func hmacSha256(key: openArray[uint8]; data: openArray[uint8]): array[0..31, uint8]
func initHmacSha384(key: openArray[uint8]): HmacSha384
func update(h: var HmacSha384; data: openArray[uint8])
func finish(h: HmacSha384): array[0..47, uint8]
func hmacSha384(key: openArray[uint8]; data: openArray[uint8]): array[0..47, uint8]
func hkdfExtractSha256(salt: openArray[uint8]; ikm: openArray[uint8]): array[0..31, uint8]
HKDF-Extract(salt, IKM). An empty salt means a string of zeros the length of the hash, which HMAC's key padding makes the same thing.
func hkdfExpandSha256`body(prk`b: openArray[uint8]; info`b: openArray[uint8]; outLen`b: int64): seq[uint8]
HKDF-Expand(PRK, info, L).
func hkdfExpandSha256(prk: openArray[uint8]; info: openArray[uint8]; outLen: int64): seq[uint8]
HKDF-Expand(PRK, info, L).
func hkdfExtractSha384(salt: openArray[uint8]; ikm: openArray[uint8]): array[0..47, uint8]
func hkdfExpandSha384`body(prk`b: openArray[uint8]; info`b: openArray[uint8]; outLen`b: int64): seq[uint8]
func hkdfExpandSha384(prk: openArray[uint8]; info: openArray[uint8]; outLen: int64): seq[uint8]
func constantTimeEquals(a: openArray[uint8]; b: openArray[uint8]): bool
Whether a and b hold the same bytes, in time that depends only on their lengths. A MAC check must use this: an early return false tells a forger how many leading bytes of a guess were right.