Expand description
SHA-256 (FIPS 180-4) and HMAC-SHA256 (RFC 2104), for code that must sign
or verify without an optional crypto dependency — e.g. the MCP server’s
requestState (MCP 2026-07-28). Not constant-time beyond verify’s
comparison; not for secrets that a timing side channel would expose.
Functions§
- hmac_
sha256 - HMAC-SHA256 of
messageunderkey. - sha256
- SHA-256 of
data. - verify
- Whether
macis the HMAC-SHA256 ofmessageunderkey, compared in constant time.