Struct HmacSm3 

pub struct HmacSm3 { /* private fields */ }

Streaming HMAC-SM3 (v0.3 W5).

Construct with new(&key), feed message chunks via update, finalize with finalize (32-byte tag) or verify (constant- time compare against an expected tag).

Equivalent to hmac_sm3 for the same (key, message) byte sequence — chunking does not affect the output.

Zeroization

The pre-computed outer keyed-state (SM3 after absorbing K' XOR opad) holds key-derived material. HmacSm3::finalize and HmacSm3::verify consume self and zeroize it before returning. If the caller drops the HmacSm3 without calling either method, the Drop impl wipes the state.

Implementations

impl HmacSm3

pub fn new(key: &[u8]) -> Self

Construct a new keyed HMAC-SM3 instance.

key may be any length; the standard RFC 2104 hash-first reduction applies for key.len() > 64. Both intermediate K' / K' XOR ipad / K' XOR opad buffers are zeroized after the inner/outer SM3 instances absorb them.

pub fn update(&mut self, data: &[u8])

Absorb message bytes into the inner hash.

pub fn finalize(self) -> [u8; 32]

Consume the instance and produce the 32-byte MAC tag.

The outer keyed-state and the inner final state are both dropped after consuming self; Sm3’s Drop impl is the one we rely on here. To be defensive against a future change where Sm3 is no longer ZeroizeOnDrop, both fields are explicitly wiped via clone-then-drop would be safer — but Sm3 does not currently implement Zeroize directly. The state is consumed by outer.finalize() which produces the public output and discards the rest.

pub fn verify(self, expected: &[u8; 32]) -> bool

Constant-time verify a candidate tag against the finalized HMAC. Returns true on match.

Trait Implementations

impl Mac for HmacSm3

type Output = [u8; 32]

The fixed-size MAC tag output.

fn new(key: &[u8]) -> Self

Construct a fresh MAC keyed with key.

fn update(&mut self, data: &[u8])

Absorb message bytes.

fn finalize(self) -> Self::Output

Consume the MAC instance and produce the final tag.

fn verify(self, expected: &Self::Output) -> bool

Verify a candidate tag against the computed one in constant-time. Returns true on match. Implementations MUST use a constant-time comparison primitive (e.g. subtle::ConstantTimeEq).