Struct MacKey 

pub struct MacKey { /* private fields */ }

A MAC key: an unforgeable capability, bound to one algorithm at creation.

sign and verify are one-shot and stateless per call, mirroring crypto.subtle.sign/verify. The byte stream is the only ingestion path; the result is chunking-invariant.

Security:

• A closed input stream carries no verdict: an operation computes correctly over whatever prefix a failed producer delivered. See README.md, “Streaming contract” (truncating producers).

Callers with several operations in flight must feed and drain them concurrently, or they can deadlock; see README.md, “Streaming contract” (making progress, returned streams).

For the meaning of extractable and the getter conventions, see README.md, “Extractability” and “Getter conventions”.

Implementations

impl MacKey

pub async fn sign(&self, data: StreamReader<u8>) -> Result<Vec<u8>, Error>

Compute the authentication tag over an entire byte stream keyed by this key. A success resolves only after the stream is fully drained (its writer dropped).

Fails only for operational reasons (error.other).

impl MacKey

pub async fn verify( &self, data: StreamReader<u8>, tag: Vec<u8>, ) -> Result<(), Error>

Verify tag against the tag computed over an entire byte stream keyed by this key, in constant time. Both verdicts — ok and error.authentication-failed — are computed over the entire stream and resolve only after it is fully drained.

Fails with error.authentication-failed if the tag does not verify. Returns a result, not a bool: an ignored boolean fails open, a dropped result does not.

impl MacKey

pub fn algorithm_name(&self) -> String

The registry name of the algorithm family this key is bound to, e.g. "HMAC" (WebCrypto’s KeyAlgorithm.name). The algorithm’s parameters are separate getters (algorithm-hash, algorithm-length), so future parameters are new getters rather than changes to a shared type.

impl MacKey

pub fn algorithm_hash(&self) -> Option<String>

The registry name of the digest this key’s algorithm is parameterized over, if any: e.g. "SHA-256" for HMAC-SHA-256 (WebCrypto’s HmacKeyAlgorithm.hash). none for MAC algorithms not built on a digest.

impl MacKey

pub fn algorithm_length(&self) -> u32

The key length in bits (WebCrypto’s HmacKeyAlgorithm.length).

impl MacKey

pub fn extractable(&self) -> bool

Whether the key material may be exported.

impl MacKey

pub fn can_sign(&self) -> bool

Whether this key permits sign. A refused operation fails error.not-permitted.

impl MacKey

pub fn can_verify(&self) -> bool

Whether this key permits verify. See can-sign.

impl MacKey

pub async fn export_key_raw(&self) -> Result<Vec<u8>, Error>

The raw key material. Fails with error.not-extractable unless the key was created with extractable true.

impl MacKey

pub async fn export_key_jwk(&self) -> Result<String, Error>

The key as an RFC 7517 JSON Web Key, behind the same extractability gate as export-key-raw. See README.md, “JWK contract”.

impl MacKey

pub async fn to_wrap_input_raw(&self) -> Result<WrapInput, Error>

This key’s raw material as a wrap-input, for wrapping under another key (see the wrapping interface). Behind the same extractability gate as export-key-raw; the material itself never reaches the caller.

impl MacKey

pub async fn to_wrap_input_jwk(&self) -> Result<WrapInput, Error>

The JWK serialization as a wrap-input, behind the same gate. See README.md, “JWK contract”.

Trait Implementations

impl Debug for MacKey

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl From<MacKey> for Mac

fn from(raw: MacKey) -> Self

Converts to this type from the input type.