crypto.hmac-sha256

pub fn hmac_sha256(key: &[i64], message: &[i64]) -> Vec<i64>

fune!(crypto.hmac-sha256@^1);  // then call hmac_sha256(…)

use super::funejson::Value;  ← the fune runtime: the JSON value the test vectors use; fune build keeps it only where a signature takes one
use super::crypto_sha256::sha256;  ← from crypto.sha256 ^1.0.0 · built alongside by fune

const BLOCK: usize = 64;

fn check_bytes(value: &[i64], name: &str) {
    if value.iter().any(|b| !(0..=255).contains(b)) {
        panic!("{} must be a list of integers from 0 to 255", name);
    }
}

/// HMAC-SHA256 (RFC 2104): H((K ^ opad) || H((K ^ ipad) || message)), with a
/// key longer than the 64-byte block hashed down to 32 bytes first.
///
/// # Panics
/// Panics if any key or message value is outside 0-255.
pub fn hmac_sha256(key: &[i64], message: &[i64]) -> Vec<i64> {
    check_bytes(key, "key");
    check_bytes(message, "message");
    let hashed;
    let k: &[i64] = if key.len() > BLOCK {
        hashed = sha256(key);
        &hashed
    } else {
        key
    };
    let mut inner: Vec<i64> = Vec::with_capacity(BLOCK + message.len());
    let mut outer: Vec<i64> = Vec::with_capacity(BLOCK + 32);
    for i in 0..BLOCK {
        let b = if i < k.len() { k[i] } else { 0 };
        inner.push(b ^ 0x36);
        outer.push(b ^ 0x5c);
    }
    inner.extend_from_slice(message);
    outer.extend(sha256(&inner));
    sha256(&outer)
}

fn bytes_from_value(value: &Value, name: &str) -> Vec<i64> {
    match value {
        Value::Arr(items) => items
            .iter()
            .map(|item| match item {
                Value::Int(i) => *i,
                _ => panic!("{} must be a list of integers from 0 to 255", name),
            })
            .collect(),
        _ => panic!("{} must be a list of integers from 0 to 255", name),
    }
}

pub fn fune_vector(args: &[Value]) -> Value {
    let key = bytes_from_value(&args[0], "key");
    let message = bytes_from_value(&args[1], "message");
    Value::Arr(hmac_sha256(&key, &message).into_iter().map(Value::Int).collect())
}

Install

fune build

With that line in your source, in a Rust project (language rust in fune.project), fune build resolves it and its 1 dependency, pins them in fune.lock, downloads only the Rust package of each, and builds the code above into your project’s .fune/build, one readable file per capability with a header linking back here. A crate’s build.rs runs it before every compile. Or pin a range in fune.project and build in one step:

fune add crypto.hmac-sha256

The manifest, vectors and README with only the Rust implementation. Install it without the registry with fune add ./crypto.hmac-sha256-1.0.0-rust.fune, or fetch it from a terminal with fune pull crypto.hmac-sha256@1.0.0:rust.

The whole function, every language, is one file too: crypto.hmac-sha256-1.0.0.fune, 14,277 bytes, sha256 aefbaef231a3cc8016bbff5c5226b4169f41ea671335aac1093c35e6d5bbf81e. It installs into a project of any language.

// fune: before crypto.hmac-sha256

// fune: after crypto.hmac-sha256

// fune: replace crypto.sha256 in crypto.hmac-sha256

// fune: step crypto.hmac-sha256 after <n|label>

More from the author

The construction is `H((K xor opad) || H((K xor ipad) || message))` with the key zero-padded to SHA-256's 64-byte block, or first hashed to 32 bytes when it is longer than 64. That last rule is the one a naive implementation misses, and RFC 4231 test cases 6 and 7 (a 131-byte key) are among the vectors. The empty key is allowed, as the RFC allows it, but a real key should be at least 32 random bytes (RFC 2104 section 3; RFC 7518 requires it for HS256).

**Compare tags with `crypto.constant-time-equal`.** Comparing with `==` stops at the first differing byte, and the time that takes tells an attacker how many leading bytes of a forged tag were right.

TypeScript and Rust build on `crypto.sha256` and so run anywhere, the browser included, with no `node:crypto` or `crypto.subtle`; Python uses the standard library's `hmac`. Test case 5 of RFC 4231 publishes only the first 16 bytes of its tag; its vector holds the full 32, computed with Python's `hmac` module as the reference, and begins with the RFC's 16.

Source: RFC 2104, HMAC: Keyed-Hashing for Message Authentication (https://www.rfc-editor.org/rfc/rfc2104); RFC 4231, Identifiers and Test Vectors for HMAC-SHA-224, HMAC-SHA-256, HMAC-SHA-384, and HMAC-SHA-512, section 4 (https://www.rfc-editor.org/rfc/rfc4231).

Files