polymorph_webcrypto_guest/
hmac_sha2.rs

1//! `hmac-sha2` key creation.
2
3use crate::{bindings, Error, Mac, MacKeyOptions};
4
5pub use crate::bindings::sha2::Sha2Variant;
6
7/// Import raw key material as an HMAC key over `variant`.
8pub async fn import_key_raw(
9    variant: Sha2Variant,
10    raw: impl Into<Vec<u8>>,
11    options: MacKeyOptions,
12) -> Result<Mac, Error> {
13    Ok(Mac::from_raw(
14        bindings::hmac_sha2::import_key_raw(variant, raw.into(), options.lower()).await?,
15    ))
16}
17
18/// Import an RFC 7517 `oct` JSON Web Key (as JSON text) as an HMAC key
19/// over `variant`. See the WIT `mac-key.export-key-jwk` doc for the
20/// package-wide JWK contract.
21pub async fn import_key_jwk(
22    variant: Sha2Variant,
23    jwk: impl Into<String>,
24    options: MacKeyOptions,
25) -> Result<Mac, Error> {
26    Ok(Mac::from_raw(
27        bindings::hmac_sha2::import_key_jwk(variant, jwk.into(), options.lower()).await?,
28    ))
29}
30
31/// Generate a fresh random HMAC key over `variant`.
32///
33/// `length` is the key length in bits; `None` means the underlying hash's
34/// block size (WebCrypto's `generateKey` default).
35pub async fn generate_key(
36    variant: Sha2Variant,
37    length: Option<u32>,
38    options: MacKeyOptions,
39) -> Result<Mac, Error> {
40    Ok(Mac::from_raw(
41        bindings::hmac_sha2::generate_key(variant, length, options.lower()).await?,
42    ))
43}
44
45/// Mint an HMAC key over `variant` from a parameterized derivation: the
46/// derivation runs at `length` bits (`None` means the hash's block size,
47/// the `generate_key` default) and the result is subject to
48/// [`import_key_raw`]'s contract.
49///
50/// Requires the input's [`derive_key`](crate::DeriveOptions::derive_key)
51/// grant — and, for an *extractable* key, [`derive_bits`] too (an
52/// exportable key is bits disclosure by other means); refusals fail
53/// [`Error::NotPermitted`].
54///
55/// [`derive_bits`]: crate::DeriveOptions::derive_bits
56pub async fn derive_key(
57    variant: Sha2Variant,
58    input: &crate::DeriveInput,
59    length: Option<u32>,
60    options: MacKeyOptions,
61) -> Result<Mac, Error> {
62    Ok(Mac::from_raw(
63        bindings::hmac_sha2::derive_key(variant, input.as_raw(), length, options.lower()).await?,
64    ))
65}
66
67/// Mint an HMAC key over the declared SHA-2 variant from unwrapped key
68/// material read as raw bytes. Consumes the
69/// [`UnwrapInput`](crate::UnwrapInput).
70pub async fn unwrap_key_raw(
71    variant: Sha2Variant,
72    input: crate::UnwrapInput,
73    options: MacKeyOptions,
74) -> Result<Mac, Error> {
75    Ok(Mac::from_raw(
76        bindings::hmac_sha2::unwrap_key_raw(variant, input.into_raw(), options.lower()).await?,
77    ))
78}
79
80/// Mint an HMAC key from unwrapped key material read as an `oct` JWK,
81/// with the unwrap-path `use`/`key_ops` checks. Consumes the
82/// [`UnwrapInput`](crate::UnwrapInput).
83pub async fn unwrap_key_jwk(
84    variant: Sha2Variant,
85    input: crate::UnwrapInput,
86    options: MacKeyOptions,
87) -> Result<Mac, Error> {
88    Ok(Mac::from_raw(
89        bindings::hmac_sha2::unwrap_key_jwk(variant, input.into_raw(), options.lower()).await?,
90    ))
91}
polymorph_webcrypto_guest/hmac_sha2.rs

polymorph_webcrypto_guest/
hmac_sha2.rs
