hmac_sha256.h File Reference

HMAC-SHA2-256 (RFC 2104 + FIPS 198-1) - streaming context and one-shot API. More...

#include "protocore_config.h"

Go to the source code of this file.

Classes
struct	HmacSha256Ns
	Dispatch table. Addressed by offset, so the layout is asserted below. More...

Macros
#define	PROTOCORE_HMAC_SHA256_LEN   32
	HMAC-SHA2-256 output length in bytes.

Functions
	PROTOCORE_NS_LAYOUT (HmacSha256Ns, init, update, final, mac)
proto_bool	protocore_hmac_sha256_init (uint8_t *work, const uint8_t *key, size_t key_len)
	Start a MAC under HmacSha256Ns::key_args.
proto_bool	protocore_hmac_sha256_update (uint8_t *work, const uint8_t *data, size_t len)
	Feed the running MAC a chunk.
proto_bool	protocore_hmac_sha256_final (uint8_t *work, uint8_t *out)
	Finish, writing the 32 bytes out.
proto_bool	protocore_hmac_sha256_mac (uint8_t *work, const uint8_t *key, size_t key_len, const uint8_t *data, size_t len, uint8_t *out)
	Init, update and final in one call, for a message already whole.

Variables
PROTOCORE_NS HmacSha256Ns HmacSha256	PROTOCORE_UNUSED
	Module namespace.

Detailed Description

HMAC-SHA2-256 (RFC 2104 + FIPS 198-1) - streaming context and one-shot API.

The shared keyed-MAC primitive for the whole library: SSH binary-packet MAC (RFC 4253 §6.4), the TLS 1.3 / QUIC / DTLS HKDF PRF, SNMPv3 usmHMACSHAAuthProtocol, JWT HS256, CSRF tokens, and SMB 2.x message signing / the SP800-108 KDF. Built over the Sha256Ns entries, so which arm compresses the inner hash is not visible here.

RFC 2104 construction: HMAC(K, m) = H((K XOR opad) || H((K XOR ipad) || m)), H = SHA-256.

SECURITY NOTE - a MAC must be verified before the covered plaintext is acted upon; that ordering guarantee lives in each protocol's packet layer, not here. These functions are pure crypto.

For a MAC assembled from separate pieces - the SSH packet MAC over (uint32_be(seq_num) || plaintext_packet):

work is PROTOCORE_HMAC_SHA256_BORROW secure bytes the CALLER took, at an address it knows. It is not held past the call, so nothing here aliases it. The caller releases it, and the pool wipes on release; this module neither takes it, holds it, releases it, nor wipes it. A connection takes those bytes once for its slot and passes them on every packet.

Author

Douglas Quigg (dstroy0)

Date

2026

Definition in file hmac_sha256.h.

Macro Definition Documentation

PROTOCORE_HMAC_SHA256_LEN

#define PROTOCORE_HMAC_SHA256_LEN   32

HMAC-SHA2-256 output length in bytes.

Definition at line 38 of file hmac_sha256.h.

Function Documentation

PROTOCORE_NS_LAYOUT()

PROTOCORE_NS_LAYOUT	(	HmacSha256Ns	,
		init	,
		update	,
		final	,
		mac
	)

protocore_hmac_sha256_init()

proto_bool protocore_hmac_sha256_init	(	uint8_t *	work,
		const uint8_t *	key,
		size_t	key_len
	)

Start a MAC under HmacSha256Ns::key_args.

Parameters

work	PROTOCORE_HMAC_SHA256_BORROW bytes the caller took. Not held past the call.
key	MAC key bytes
key_len	key length; > 64 is pre-hashed (RFC 2104), shorter is zero-padded to the block

Returns

PROTO_TRUE on success.

protocore_hmac_sha256_update()

proto_bool protocore_hmac_sha256_update	(	uint8_t *	work,
		const uint8_t *	data,
		size_t	len
	)

Feed the running MAC a chunk.

Parameters

work	PROTOCORE_HMAC_SHA256_BORROW bytes the caller took. Not held past the call.
data	the bytes
len	how many

Returns

PROTO_TRUE on success.

protocore_hmac_sha256_final()

proto_bool protocore_hmac_sha256_final	(	uint8_t *	work,
		uint8_t *	out
	)

Finish, writing the 32 bytes out.

Parameters

work	PROTOCORE_HMAC_SHA256_BORROW bytes the caller took. Not held past the call.
out	PROTOCORE_HMAC_SHA256_LEN bytes

Returns

PROTO_TRUE on success.

protocore_hmac_sha256_mac()

proto_bool protocore_hmac_sha256_mac	(	uint8_t *	work,
		const uint8_t *	key,
		size_t	key_len,
		const uint8_t *	data,
		size_t	len,
		uint8_t *	out
	)

Init, update and final in one call, for a message already whole.

Parameters

work	PROTOCORE_HMAC_SHA256_BORROW bytes the caller took. Not held past the call.
key	MAC key bytes
key_len	key length
data	the message
len	its length
out	PROTOCORE_HMAC_SHA256_LEN bytes

Returns

PROTO_TRUE on success.

Variable Documentation

PROTOCORE_UNUSED

PROTOCORE_NS HmacSha256Ns HmacSha256 PROTOCORE_UNUSED

Initial value:

= {.init = protocore_hmac_sha256_init,
                                                         .update = protocore_hmac_sha256_update,
                                                         .final = protocore_hmac_sha256_final,
                                                         .mac = protocore_hmac_sha256_mac}

Module namespace.

Definition at line 87 of file hmac_sha256.h.