27 lines
994 B
TypeScript
27 lines
994 B
TypeScript
import { hmac as nobleHmac } from "@noble/hashes/hmac";
|
|
import { sha1 } from "@noble/hashes/sha1";
|
|
import { hmac as suaveplanHmac } from "@suaveplan/crypto-hash";
|
|
import type { HotpAlgorithm } from "./hotp.types.js";
|
|
|
|
/**
|
|
* Compute HMAC over `data` keyed by `key` using one of the algorithms RFC 6238
|
|
* §1.2 permits for OTP. SHA-256 and SHA-512 route through `@suaveplan/crypto-hash`
|
|
* (the canonical HMAC façade); SHA-1 routes through `@noble/hashes/sha1`
|
|
* directly because crypto-hash does not expose SHA-1 (it is RFC-mandated for
|
|
* OTP backwards-compat ONLY and must not be presented as a general-purpose
|
|
* choice elsewhere in the platform).
|
|
*/
|
|
export function hmacFor(
|
|
algorithm: HotpAlgorithm,
|
|
key: Uint8Array,
|
|
data: Uint8Array
|
|
): Uint8Array {
|
|
if (algorithm === "SHA1") {
|
|
return nobleHmac(sha1, key, data);
|
|
}
|
|
if (algorithm === "SHA256") {
|
|
return suaveplanHmac("SHA-256", key, data);
|
|
}
|
|
return suaveplanHmac("SHA-512", key, data);
|
|
}
|