Skip to content

Rust wrapper: add HMAC-BLAKE2[bs] wrappers #9687

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
dgarske merged 4 commits into from
Jan 21, 2026
+407 −5
Merged

Rust wrapper: add HMAC-BLAKE2[bs] wrappers #9687

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
a555d52
Rust wrapper: add HMAC-BLAKE2[bs] wrappers
holtrop-wolfssl Jan 12, 2026
af0fd01
HMAC-BLAKE2b: avoid coverity complaints about accessing x_key out of …
holtrop-wolfssl Jan 20, 2026
e59ddb9
Rust blake2: remove unnecessary cfg guards
holtrop-wolfssl Jan 20, 2026
4a92ee3
Rust HMAC-BLAKE2: require exact output buffer size
holtrop-wolfssl Jan 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 6 additions & 2 deletions wolfcrypt/src/blake2b.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -534,7 +534,9 @@ int wc_Blake2bHmacInit(Blake2b* b2b, const byte* key, size_t key_len)
ret = wc_Blake2bFinal(b2b, x_key, 0);
} else {
XMEMCPY(x_key, key, key_len);
XMEMSET(x_key + key_len, 0, BLAKE2B_BLOCKBYTES - key_len);
if (key_len < BLAKE2B_BLOCKBYTES) {
XMEMSET(x_key + key_len, 0, BLAKE2B_BLOCKBYTES - key_len);
}
}

if (ret == 0) {
Expand Down Expand Up @@ -581,7 +583,9 @@ int wc_Blake2bHmacFinal(Blake2b* b2b, const byte* key, size_t key_len,
ret = wc_Blake2bFinal(b2b, x_key, 0);
} else {
XMEMCPY(x_key, key, key_len);
XMEMSET(x_key + key_len, 0, BLAKE2B_BLOCKBYTES - key_len);
if (key_len < BLAKE2B_BLOCKBYTES) {
XMEMSET(x_key + key_len, 0, BLAKE2B_BLOCKBYTES - key_len);
}
}

if (ret == 0) {
Expand Down
8 changes: 6 additions & 2 deletions wolfcrypt/src/blake2s.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -528,7 +528,9 @@ int wc_Blake2sHmacInit(Blake2s* b2s, const byte* key, size_t key_len)
ret = wc_Blake2sFinal(b2s, x_key, 0);
} else {
XMEMCPY(x_key, key, key_len);
XMEMSET(x_key + key_len, 0, BLAKE2S_BLOCKBYTES - key_len);
if (key_len < BLAKE2S_BLOCKBYTES) {
XMEMSET(x_key + key_len, 0, BLAKE2S_BLOCKBYTES - key_len);
}
}

if (ret == 0) {
Expand Down Expand Up @@ -575,7 +577,9 @@ int wc_Blake2sHmacFinal(Blake2s* b2s, const byte* key, size_t key_len,
ret = wc_Blake2sFinal(b2s, x_key, 0);
} else {
XMEMCPY(x_key, key, key_len);
XMEMSET(x_key + key_len, 0, BLAKE2S_BLOCKBYTES - key_len);
if (key_len < BLAKE2S_BLOCKBYTES) {
XMEMSET(x_key + key_len, 0, BLAKE2S_BLOCKBYTES - key_len);
}
}

if (ret == 0) {
Expand Down
2 changes: 2 additions & 0 deletions wrapper/rust/wolfssl-wolfcrypt/build.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -128,7 +128,9 @@ fn scan_cfg() -> Result<()> {

/* blake2 */
check_cfg(&binding, "wc_InitBlake2b", "blake2b");
check_cfg(&binding, "wc_Blake2bHmac", "blake2b_hmac");
check_cfg(&binding, "wc_InitBlake2s", "blake2s");
check_cfg(&binding, "wc_Blake2sHmac", "blake2s_hmac");

/* chacha20_poly1305 */
check_cfg(&binding, "wc_ChaCha20Poly1305_Encrypt", "chacha20_poly1305");
Expand Down
271 changes: 270 additions & 1 deletion wrapper/rust/wolfssl-wolfcrypt/src/blake2.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -167,6 +167,141 @@ impl BLAKE2b {
}
}


/// Context for HMAC-BLAKE2b computation.
#[cfg(blake2b_hmac)]
pub struct BLAKE2bHmac {
wc_blake2b: sys::Blake2b,
}

#[cfg(blake2b_hmac)]
impl BLAKE2bHmac {
/// Build a new BLAKE2bHmac instance.
///
/// # Parameters
///
/// * `key`: Key to use for HMAC-BLAKE2b computation.
///
/// # Returns
///
/// Returns either Ok(hmac_blake2b) or Err(e) containing the wolfSSL
/// library error code value.
///
/// # Example
///
/// ```rust
/// use wolfssl_wolfcrypt::blake2::BLAKE2bHmac;
/// let key = [42u8, 43, 44];
/// let hmac_blake2b = BLAKE2bHmac::new(&key).expect("Error with new()");
/// ```
pub fn new(key: &[u8]) -> Result<Self, i32> {
let mut wc_blake2b: MaybeUninit<sys::Blake2b> = MaybeUninit::uninit();
let rc = unsafe {
sys::wc_Blake2bHmacInit(wc_blake2b.as_mut_ptr(), key.as_ptr(), key.len())
};
if rc != 0 {
return Err(rc);
}
let wc_blake2b = unsafe { wc_blake2b.assume_init() };
let hmac_blake2b = BLAKE2bHmac { wc_blake2b };
Ok(hmac_blake2b)
}

/// Update the HMAC-BLAKE2b computation with the input data.
///
/// This method may be called several times and then the finalize()
/// method should be called to retrieve the final MAC.
///
/// # Parameters
///
/// * `data`: Input data to hash.
///
/// # Returns
///
/// Returns either Ok(()) on success or Err(e) containing the wolfSSL
/// library error code value.
///
/// # Example
///
/// ```rust
/// use wolfssl_wolfcrypt::blake2::BLAKE2bHmac;
/// let key = [42u8, 43, 44];
/// let mut hmac_blake2b = BLAKE2bHmac::new(&key).expect("Error with new()");
/// let data = [33u8, 34, 35];
/// hmac_blake2b.update(&data).expect("Error with update()");
/// ```
pub fn update(&mut self, data: &[u8]) -> Result<(), i32> {
let rc = unsafe {
sys::wc_Blake2bHmacUpdate(&mut self.wc_blake2b, data.as_ptr(), data.len())
};
if rc != 0 {
return Err(rc);
}
Ok(())
}

/// Compute and retrieve the final HMAC-BLAKE2b MAC.
///
/// # Parameters
///
/// * `key`: Key to use for HMAC-BLAKE2b computation.
/// * `mac`: Output buffer in which to store the computed HMAC-BLAKE2b MAC.
/// It must be 64 bytes long.
///
/// # Returns
///
/// Returns either Ok(()) on success or Err(e) containing the wolfSSL
/// library error code value.
///
/// # Example
///
/// ```rust
/// use wolfssl_wolfcrypt::blake2::BLAKE2bHmac;
/// let key = [42u8, 43, 44];
/// let mut hmac_blake2b = BLAKE2bHmac::new(&key).expect("Error with new()");
/// let data = [33u8, 34, 35];
/// hmac_blake2b.update(&data).expect("Error with update()");
/// let mut mac = [0u8; 64];
/// hmac_blake2b.finalize(&key, &mut mac).expect("Error with finalize()");
/// ```
pub fn finalize(&mut self, key: &[u8], mac: &mut [u8]) -> Result<(), i32> {
let rc = unsafe {
sys::wc_Blake2bHmacFinal(&mut self.wc_blake2b,
key.as_ptr(), key.len(), mac.as_mut_ptr(), mac.len())
};
if rc != 0 {
return Err(rc);
}
Ok(())
}

/// Compute the HMAC-BLAKE2b message authentication code of the given
/// input data using the given key (one-shot API).
///
/// # Parameters
///
/// * `data`: Input data to create MAC from.
/// * `key`: Key to use for MAC creation.
/// * `out`: Buffer in which to store the computed MAC.
///
/// # Returns
///
/// Returns either Ok(()) on success or Err(e) containing the wolfSSL
/// library error code value.
#[cfg(blake2b_hmac)]
pub fn hmac(data: &[u8], key: &[u8], out: &mut [u8]) -> Result<(), i32> {
let rc = unsafe {
sys::wc_Blake2bHmac(data.as_ptr(), data.len(), key.as_ptr(),
key.len(), out.as_mut_ptr(), out.len())
};
if rc != 0 {
return Err(rc);
}
Ok(())
}
}


/// Context for BLAKE2s computation.
#[cfg(blake2s)]
pub struct BLAKE2s {
Expand Down Expand Up @@ -291,7 +426,7 @@ impl BLAKE2s {
/// use wolfssl_wolfcrypt::blake2::BLAKE2s;
/// let mut blake2s = BLAKE2s::new(32).expect("Error with new()");
/// blake2s.update(&[0u8; 16]).expect("Error with update()");
/// let mut hash = [0u8; 64];
/// let mut hash = [0u8; 32];
/// blake2s.finalize(&mut hash).expect("Error with finalize()");
/// ```
pub fn finalize(&mut self, hash: &mut [u8]) -> Result<(), i32> {
Expand All @@ -305,3 +440,137 @@ impl BLAKE2s {
Ok(())
}
}


/// Context for HMAC-BLAKE2s computation.
#[cfg(blake2s_hmac)]
pub struct BLAKE2sHmac {
wc_blake2s: sys::Blake2s,
}

#[cfg(blake2s_hmac)]
impl BLAKE2sHmac {
/// Build a new BLAKE2sHmac instance.
///
/// # Parameters
///
/// * `key`: Key to use for HMAC-BLAKE2s computation.
///
/// # Returns
///
/// Returns either Ok(hmac_blake2s) or Err(e) containing the wolfSSL
/// library error code value.
///
/// # Example
///
/// ```rust
/// use wolfssl_wolfcrypt::blake2::BLAKE2sHmac;
/// let key = [42u8, 43, 44];
/// let hmac_blake2s = BLAKE2sHmac::new(&key).expect("Error with new()");
/// ```
pub fn new(key: &[u8]) -> Result<Self, i32> {
let mut wc_blake2s: MaybeUninit<sys::Blake2s> = MaybeUninit::uninit();
let rc = unsafe {
sys::wc_Blake2sHmacInit(wc_blake2s.as_mut_ptr(), key.as_ptr(), key.len())
};
if rc != 0 {
return Err(rc);
}
let wc_blake2s = unsafe { wc_blake2s.assume_init() };
let hmac_blake2s = BLAKE2sHmac { wc_blake2s };
Ok(hmac_blake2s)
}

/// Update the HMAC-BLAKE2s computation with the input data.
///
/// This method may be called several times and then the finalize()
/// method should be called to retrieve the final MAC.
///
/// # Parameters
///
/// * `data`: Input data to hash.
///
/// # Returns
///
/// Returns either Ok(()) on success or Err(e) containing the wolfSSL
/// library error code value.
///
/// # Example
///
/// ```rust
/// use wolfssl_wolfcrypt::blake2::BLAKE2sHmac;
/// let key = [42u8, 43, 44];
/// let mut hmac_blake2s = BLAKE2sHmac::new(&key).expect("Error with new()");
/// let data = [33u8, 34, 35];
/// hmac_blake2s.update(&data).expect("Error with update()");
/// ```
pub fn update(&mut self, data: &[u8]) -> Result<(), i32> {
let rc = unsafe {
sys::wc_Blake2sHmacUpdate(&mut self.wc_blake2s, data.as_ptr(), data.len())
};
if rc != 0 {
return Err(rc);
}
Ok(())
}

/// Compute and retrieve the final HMAC-BLAKE2s MAC.
///
/// # Parameters
///
/// * `key`: Key to use for HMAC-BLAKE2s computation.
/// * `mac`: Output buffer in which to store the computed HMAC-BLAKE2s MAC.
/// It must be 32 bytes long.
///
/// # Returns
///
/// Returns either Ok(()) on success or Err(e) containing the wolfSSL
/// library error code value.
///
/// # Example
///
/// ```rust
/// use wolfssl_wolfcrypt::blake2::BLAKE2sHmac;
/// let key = [42u8, 43, 44];
/// let mut hmac_blake2s = BLAKE2sHmac::new(&key).expect("Error with new()");
/// let data = [33u8, 34, 35];
/// hmac_blake2s.update(&data).expect("Error with update()");
/// let mut mac = [0u8; 32];
/// hmac_blake2s.finalize(&key, &mut mac).expect("Error with finalize()");
/// ```
pub fn finalize(&mut self, key: &[u8], mac: &mut [u8]) -> Result<(), i32> {
let rc = unsafe {
sys::wc_Blake2sHmacFinal(&mut self.wc_blake2s,
key.as_ptr(), key.len(), mac.as_mut_ptr(), mac.len())
};
if rc != 0 {
return Err(rc);
}
Ok(())
}

/// Compute the HMAC-BLAKE2s message authentication code of the given
/// input data using the given key (one-shot API).
///
/// # Parameters
///
/// * `data`: Input data to create MAC from.
/// * `key`: Key to use for MAC creation.
/// * `out`: Buffer in which to store the computed MAC.
///
/// # Returns
///
/// Returns either Ok(()) on success or Err(e) containing the wolfSSL
/// library error code value.
#[cfg(blake2s_hmac)]
pub fn hmac(data: &[u8], key: &[u8], out: &mut [u8]) -> Result<(), i32> {
let rc = unsafe {
sys::wc_Blake2sHmac(data.as_ptr(), data.len(), key.as_ptr(),
key.len(), out.as_mut_ptr(), out.len())
};
if rc != 0 {
return Err(rc);
}
Ok(())
}
}
Loading