hmac_sha256.h File Reference

HMAC-SHA2-256 (RFC 2104 + FIPS 198-1) - streaming context and one-shot API. More...

#include "crypto/hash/sha256.h"
#include <stddef.h>
#include <stdint.h>

Go to the source code of this file.

Classes
struct	pc_hmac_sha256_ctx
	Streaming HMAC-SHA2-256 context. More...

Macros
#define	PC_HMAC_SHA256_LEN   32
	HMAC-SHA2-256 output length in bytes.

Functions
void	pc_hmac_sha256 (const uint8_t *key, size_t key_len, const uint8_t *data, size_t len, uint8_t mac[PC_HMAC_SHA256_LEN])
	Compute HMAC-SHA2-256 over a single contiguous buffer.
void	pc_hmac_sha256_init (pc_hmac_sha256_ctx *ctx, const uint8_t *key, size_t key_len)
	Initialize a streaming HMAC-SHA2-256 context.
void	pc_hmac_sha256_update (pc_hmac_sha256_ctx *ctx, const uint8_t *data, size_t len)
	Feed len bytes into the running HMAC.
void	pc_hmac_sha256_final (pc_hmac_sha256_ctx *ctx, uint8_t mac[PC_HMAC_SHA256_LEN])
	Finalize and write the 32-byte MAC.

Detailed Description

HMAC-SHA2-256 (RFC 2104 + FIPS 198-1) - streaming context and one-shot API.

The shared keyed-MAC primitive for the whole library: SSH binary-packet MAC (RFC 4253 §6.4), the TLS 1.3 / QUIC / DTLS HKDF PRF, SNMPv3 usmHMACSHAAuthProtocol, JWT HS256, CSRF tokens, and SMB 2.x message signing / the SP800-108 KDF. Built over the pc_sha256 streaming functions so the inner SHA-256 hardware acceleration (where present) is transparent.

RFC 2104 construction: HMAC(K, m) = H((K XOR opad) || H((K XOR ipad) || m)), H = SHA-256.

SECURITY NOTE - a MAC must be verified before the covered plaintext is acted upon; that ordering guarantee lives in each protocol's packet layer, not here. These functions are pure crypto.

Author

Douglas Quigg (dstroy0)

Date

2026

Definition in file hmac_sha256.h.

Macro Definition Documentation

PC_HMAC_SHA256_LEN

#define PC_HMAC_SHA256_LEN   32

HMAC-SHA2-256 output length in bytes.

Definition at line 30 of file hmac_sha256.h.

Function Documentation

pc_hmac_sha256()

void pc_hmac_sha256	(	const uint8_t *	key,
		size_t	key_len,
		const uint8_t *	data,
		size_t	len,
		uint8_t	mac[PC_HMAC_SHA256_LEN]
	)

Compute HMAC-SHA2-256 over a single contiguous buffer.

Parameters

key	MAC key bytes.
key_len	Key length in bytes. Keys > 64 bytes are pre-hashed per RFC 2104; keys <= 64 bytes are zero-padded to the block length. SSH-derived keys are always 32 bytes.
data	Input bytes.
len	Input length.
mac	Output buffer, must be PC_HMAC_SHA256_LEN bytes.

Definition at line 113 of file hmac_sha256.cpp.

References pc_span::buf, PC_SHA256_DIGEST_LEN, pc_sha256_final(), pc_sha256_init(), pc_sha256_update(), pc_span_ok(), and SecureBorrow::span().

pc_hmac_sha256_init()

void pc_hmac_sha256_init	(	pc_hmac_sha256_ctx *	ctx,
		const uint8_t *	key,
		size_t	key_len
	)

Initialize a streaming HMAC-SHA2-256 context.

Parameters

ctx	Context to initialize.
key	Key bytes (keys > 64 are pre-hashed per RFC 2104).
key_len	Length of key in bytes.

Definition at line 74 of file hmac_sha256.cpp.

References pc_span::buf, pc_hmac_sha256_ctx::inner, pc_hmac_sha256_ctx::okey, pc_sha256_init(), pc_sha256_update(), pc_span_ok(), and SecureBorrow::span().

pc_hmac_sha256_update()

void pc_hmac_sha256_update	(	pc_hmac_sha256_ctx *	ctx,
		const uint8_t *	data,
		size_t	len
	)

Feed len bytes into the running HMAC.

Definition at line 90 of file hmac_sha256.cpp.

References pc_hmac_sha256_ctx::inner, and pc_sha256_update().

pc_hmac_sha256_final()

void pc_hmac_sha256_final	(	pc_hmac_sha256_ctx *	ctx,
		uint8_t	mac[PC_HMAC_SHA256_LEN]
	)

Finalize and write the 32-byte MAC.

Definition at line 95 of file hmac_sha256.cpp.

References pc_span::buf, pc_hmac_sha256_ctx::inner, pc_hmac_sha256_ctx::okey, PC_SHA256_DIGEST_LEN, pc_sha256_final(), pc_sha256_init(), pc_sha256_update(), pc_span_ok(), and SecureBorrow::span().