Initial Commit

packages/security-stack/security/otp/src/hotp/hmac.ts

@@ -0,0 +1,26 @@
+import { hmac as nobleHmac } from "@noble/hashes/hmac";
+import { sha1 } from "@noble/hashes/sha1";
+import { hmac as suaveplanHmac } from "@suaveplan/crypto-hash";
+import type { HotpAlgorithm } from "./hotp.types.js";
+
+/**
+ * Compute HMAC over `data` keyed by `key` using one of the algorithms RFC 6238
+ * §1.2 permits for OTP. SHA-256 and SHA-512 route through `@suaveplan/crypto-hash`
+ * (the canonical HMAC façade); SHA-1 routes through `@noble/hashes/sha1`
+ * directly because crypto-hash does not expose SHA-1 (it is RFC-mandated for
+ * OTP backwards-compat ONLY and must not be presented as a general-purpose
+ * choice elsewhere in the platform).
+ */
+export function hmacFor(
+    algorithm: HotpAlgorithm,
+    key: Uint8Array,
+    data: Uint8Array
+): Uint8Array {
+    if (algorithm === "SHA1") {
+        return nobleHmac(sha1, key, data);
+    }
+    if (algorithm === "SHA256") {
+        return suaveplanHmac("SHA-256", key, data);
+    }
+    return suaveplanHmac("SHA-512", key, data);
+}