reallyme-crypto 0.3.1

Cross-platform cryptographic primitives, key formats, and conformance-tested provider bindings.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117

// SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
//
// SPDX-License-Identifier: Apache-2.0

//! Semantic owner for MAC operations.

use crypto_core::MacAlgorithm;
#[cfg(feature = "hmac")]
use crypto_core::{CryptoError, MacFailureKind};

#[cfg(feature = "hmac")]
use super::{BackendErrorReason, PrimitiveErrorReason};
use super::{OperationError, ProviderErrorReason};
use crate::secret_material::{bind_operation_policy, SecretMaterialOperation};

/// Computes a MAC tag for the selected algorithm.
///
/// The operation layer owns MAC algorithm selection so adapter boundaries route
/// through one typed error contract instead of duplicating HMAC semantics.
pub fn authenticate(
    algorithm: MacAlgorithm,
    key: &[u8],
    message: &[u8],
) -> Result<Vec<u8>, OperationError> {
    let _policy = bind_operation_policy(SecretMaterialOperation::MacAuthenticate);
    #[cfg(feature = "hmac")]
    {
        authenticate_tag(algorithm, key, message).map(crypto_hmac::HmacTag::into_vec)
    }

    #[cfg(not(feature = "hmac"))]
    {
        let _ = (algorithm, key, message);
        unsupported_mac()
    }
}

/// Verifies a MAC tag for the selected algorithm.
pub fn verify(
    algorithm: MacAlgorithm,
    key: &[u8],
    message: &[u8],
    tag: &[u8],
) -> Result<(), OperationError> {
    let _policy = bind_operation_policy(SecretMaterialOperation::MacVerify);
    #[cfg(feature = "hmac")]
    {
        let key = hmac_key_from_slice(key)?;
        crypto_hmac::verify(algorithm, &key, message, tag).map_err(map_hmac_error)
    }

    #[cfg(not(feature = "hmac"))]
    {
        let _ = (algorithm, key, message, tag);
        unsupported_mac()
    }
}

#[cfg(feature = "hmac")]
/// Computes a MAC tag while preserving the historical HMAC tag wrapper.
pub fn authenticate_tag(
    algorithm: MacAlgorithm,
    key: &[u8],
    message: &[u8],
) -> Result<crypto_hmac::HmacTag, OperationError> {
    let _policy = bind_operation_policy(SecretMaterialOperation::MacAuthenticate);
    let key = hmac_key_from_slice(key)?;
    crypto_hmac::authenticate(algorithm, &key, message).map_err(map_hmac_error)
}

#[cfg(feature = "hmac")]
fn hmac_key_from_slice(key: &[u8]) -> Result<crypto_hmac::HmacKey, OperationError> {
    crypto_hmac::HmacKey::from_slice(key).map_err(map_hmac_error)
}

#[cfg(feature = "hmac")]
fn map_hmac_error(error: CryptoError) -> OperationError {
    match error {
        CryptoError::Mac {
            kind: MacFailureKind::InvalidKeyLength,
            ..
        } => OperationError::Primitive {
            reason: PrimitiveErrorReason::InvalidKey,
        },
        CryptoError::Mac {
            kind: MacFailureKind::InvalidTagLength,
            ..
        } => OperationError::Primitive {
            reason: PrimitiveErrorReason::InvalidLength,
        },
        CryptoError::Mac {
            kind: MacFailureKind::VerificationFailed,
            ..
        } => OperationError::Primitive {
            reason: PrimitiveErrorReason::VerificationFailed,
        },
        CryptoError::Mac {
            kind: MacFailureKind::BackendFailure,
            ..
        } => OperationError::Backend {
            reason: BackendErrorReason::Internal,
        },
        CryptoError::Unsupported => OperationError::Provider {
            reason: ProviderErrorReason::UnsupportedAlgorithm,
        },
        _ => OperationError::Backend {
            reason: BackendErrorReason::Internal,
        },
    }
}

#[cfg(not(feature = "hmac"))]
fn unsupported_mac<T>() -> Result<T, OperationError> {
    Err(OperationError::Provider {
        reason: ProviderErrorReason::UnsupportedAlgorithm,
    })
}