Documentation
¶
Overview ¶
Package hmacutil computes and verifies HMAC-SHA1/SHA256/SHA512 message authentication codes. It is the keyed-MAC tier of the toolkit — the API/webhook-auth analogue of jwt_verify: verify or forge a webhook signature (GitHub X-Hub-Signature-256, Stripe-Signature, generic API request signing) with a known or leaked secret, or check a protocol's HMAC auth tag. It complements the unkeyed checksum tools (crc_compute / checksum_compute).
Wrap-vs-native judgement ¶
Native. HMAC is crypto/hmac over crypto/sha*; this is a thin, deterministic wrapper plus a named-algorithm table and a constant-time verify. Nothing to wrap.
Verifiable / no confidently-wrong output ¶
The strongest verification class: RFC 4231 publishes exact HMAC test vectors, and the unit tests assert this package reproduces them (e.g. HMAC-SHA256 with key "Jefe" over "what do ya want for nothing?" = 5bdcc146…ec3843). Verify uses a constant-time comparison.
Covered / deferred ¶
Covered: HMAC-SHA1 / SHA256 / SHA512, compute and verify. HMAC-MD5 (legacy, omitted on purpose), keyed BLAKE2, and the full AWS SigV4 multi-step signing flow are out of scope.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
Types ¶
This section is empty.
Source Files