Module hmac 

HMAC-based authentication for message integrity.

This module provides HMAC (Hash-based Message Authentication Code) functionality for ensuring message integrity and authenticity in the CHIE protocol.

Features

• HMAC-SHA256 and HMAC-BLAKE3 support
• Constant-time MAC verification
• Key derivation for HMAC keys
• Tagged authentication for different message types

Examples

use chie_crypto::hmac::{HmacKey, HmacTag, compute_hmac, verify_hmac};

// Generate a random HMAC key
let key = HmacKey::generate();

// Compute HMAC for a message
let message = b"Hello, CHIE!";
let tag = compute_hmac(&key, message);

// Verify the HMAC tag
assert!(verify_hmac(&key, message, &tag));

// Verification fails for wrong message
assert!(!verify_hmac(&key, b"Wrong message", &tag));

Security Considerations

• HMAC keys should be at least 32 bytes (256 bits)
• Use constant-time comparison for MAC verification
• Never reuse HMAC keys across different protocols
• Rotate HMAC keys periodically

Structs

AuthenticatedMessage

Authenticated message containing both data and HMAC tag.

HmacKey

HMAC key for message authentication.

HmacTag

HMAC tag (authentication code).

Enums

HmacError

HMAC errors.

Constants

HMAC_BLAKE3_TAG_SIZE

HMAC tag size for BLAKE3 in bytes.

HMAC_KEY_SIZE

HMAC key size in bytes.

HMAC_SHA256_TAG_SIZE

HMAC tag size for SHA256 in bytes.

Functions

compute_hmac

Compute HMAC for a message (defaults to BLAKE3 for performance).

compute_hmac_blake3

Compute HMAC-BLAKE3 for a message (using keyed BLAKE3).

compute_hmac_sha256

Compute HMAC-SHA256 for a message.

compute_tagged_hmac

Tagged HMAC for domain separation.

verify_hmac

Verify HMAC tag in constant time.

verify_hmac_blake3

Verify HMAC-BLAKE3 tag in constant time.

verify_hmac_sha256

Verify HMAC-SHA256 tag in constant time.

verify_tagged_hmac

Verify tagged HMAC in constant time.

Type Aliases

HmacResult

HMAC result type.