Class: Phylax::HMAC

Inherits:
Object
  • Object
show all
Defined in:
lib/phylax.rb,
ext/phylax/phylax.c

Overview

Streaming keyed MAC (HMAC-SHA-256/384/512).

m = Phylax::HMAC.new(:sha256, key)
m << "part one" << "part two"
m.hexdigest

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(name, key) ⇒ HMAC

Returns a new instance of HMAC.



166
167
168
169
170
 
# File 'lib/phylax.rb', line 166

def initialize(name, key)
  idx = HASHES.fetch(name) { raise ArgumentError, "unknown hash #{name.inspect}" }
  @name = name
  _init(idx, key)
end

Instance Attribute Details

#name ⇒ Object (readonly)

Returns the value of attribute name.



164
165
166
 
# File 'lib/phylax.rb', line 164

def name
  @name
end

Class Method Details

.verify(name, key, data, expected_tag) ⇒ Object

Compute the MAC of data under key and compare it to expected_tag in constant time. Returns true/false and never raises on mismatch — the safe way to verify a MAC.



188
189
190
191
 
# File 'lib/phylax.rb', line 188

def self.verify(name, key, data, expected_tag)
  tag = new(name, key).update(data).digest
  Phylax.secure_compare(tag, expected_tag)
end

Instance Method Details

#<<(data) ⇒ Object 



172
173
174
 
# File 'lib/phylax.rb', line 172

def <<(data)
  update(data)
end

#_init(vidx, key) ⇒ Object 



553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
 
# File 'ext/phylax/phylax.c', line 553

static VALUE
hmac_init(VALUE self, VALUE vidx, VALUE key)
{
    hmac_t *m = hmac_get(self);
    int i = alg_index(vidx);
    PUCHAR pkey;
    ULONG nkey;
    NTSTATUS st;

    nkey = str_bytes(&key, &pkey);

    if (m->h) { BCryptDestroyHash(m->h); m->h = NULL; }
    if (m->key) { SecureZeroMemory(m->key, m->keylen); free(m->key); m->key = NULL; m->keylen = 0; }

    /* Retain a private copy of the key so #reset can re-key without the caller. */
    m->key = (unsigned char *)malloc(nkey ? nkey : 1);
    if (!m->key) rb_raise(rb_eNoMemError, "phylax: out of memory");
    memcpy(m->key, pkey, nkey);
    m->keylen = nkey;

    st = BCryptCreateHash(g_hmac[i], &m->h, NULL, 0, m->key, nkey, 0);
    if (!NT_SUCCESS(st)) {
        SecureZeroMemory(m->key, m->keylen); free(m->key); m->key = NULL; m->keylen = 0;
        raise_nt("BCryptCreateHash(HMAC)", st);
    }
    m->idx = i;
    return self;
}

#digest ⇒ Object 



598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
 
# File 'ext/phylax/phylax.c', line 598

static VALUE
hmac_digest(VALUE self)
{
    hmac_t *m = hmac_get(self);
    BCRYPT_HASH_HANDLE dup = NULL;
    PUCHAR obj;
    ULONG objlen;
    NTSTATUS st;
    VALUE out;

    if (!m->h) rb_raise(eError, "phylax: hmac not initialized");

    /* Allocate the Ruby output first so the malloc below is the last resource
     * acquired; an rb_str_new (OOM) raise then leaks nothing. */
    out = rb_str_new(NULL, g_dlen[m->idx]);
    rb_enc_associate(out, rb_ascii8bit_encoding());

    objlen = g_objlen_hmac[m->idx];
    obj = (PUCHAR)malloc(objlen ? objlen : 1);
    if (!obj) rb_raise(rb_eNoMemError, "phylax: out of memory");

    st = BCryptDuplicateHash(m->h, &dup, obj, objlen, 0);
    if (NT_SUCCESS(st))
        st = BCryptFinishHash(dup, (PUCHAR)RSTRING_PTR(out), g_dlen[m->idx], 0);
    if (dup) BCryptDestroyHash(dup);
    free(obj);
    if (!NT_SUCCESS(st))
        raise_nt("BCryptDuplicateHash(HMAC)", st);

    return out;
}

#digest_length ⇒ Object 



647
648
649
650
651
652
653
 
# File 'ext/phylax/phylax.c', line 647

static VALUE
hmac_size(VALUE self)
{
    hmac_t *m = hmac_get(self);
    if (m->idx < 0) rb_raise(eError, "phylax: hmac not initialized");
    return UINT2NUM(g_dlen[m->idx]);
}

#hexdigest ⇒ Object 



176
177
178
 
# File 'lib/phylax.rb', line 176

def hexdigest
  digest.unpack1("H*")
end

#inspect ⇒ Object 



193
194
195
 
# File 'lib/phylax.rb', line 193

def inspect
  "#<Phylax::HMAC #{@name}>"
end

#reset ⇒ Object

#reset — re-create the MAC object with the retained key.



631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
 
# File 'ext/phylax/phylax.c', line 631

static VALUE
hmac_reset(VALUE self)
{
    hmac_t *m = hmac_get(self);
    BCRYPT_HASH_HANDLE nh = NULL;
    NTSTATUS st;

    if (m->idx < 0) rb_raise(eError, "phylax: hmac not initialized");
    st = BCryptCreateHash(g_hmac[m->idx], &nh, NULL, 0, m->key, m->keylen, 0);
    if (!NT_SUCCESS(st))
        raise_nt("BCryptCreateHash(HMAC)", st);
    if (m->h) BCryptDestroyHash(m->h);
    m->h = nh;
    return self;
}

#size ⇒ Object Also known as: length 



180
181
182
 
# File 'lib/phylax.rb', line 180

def size
  digest_length
end

#update(data) ⇒ Object 



582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
 
# File 'ext/phylax/phylax.c', line 582

static VALUE
hmac_update(VALUE self, VALUE data)
{
    hmac_t *m = hmac_get(self);
    PUCHAR pin;
    ULONG nin;
    NTSTATUS st;

    if (!m->h) rb_raise(eError, "phylax: hmac not initialized");
    nin = str_bytes(&data, &pin);
    st = BCryptHashData(m->h, pin, nin, 0);
    if (!NT_SUCCESS(st))
        raise_nt("BCryptHashData", st);
    return self;
}