Îõ³h*5 0æ¿      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~€‚ƒ„…†‡ˆ‰Š‹ŒŽ‘’“”•–—˜™š›œžŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾ 0.1.0.2 (c) 2024 Auth GlobalApache2None Ë Xsha256Note that this function only processes as many 64-byte blocks as possible, then discards the remainder of the input. Also note that this function does nothing to track the number of bytes that have been fed into the state, which will have to be done externally.sha256ûCast a Sha256Ctx to a Sha256State, without (much, if any) copying. This has the disadvantage that the result will retain at least 8, and up to 71 unnecessary bytes, depending on the length of the buffer. 72 extra bytes will likely be possible once this binding supports mutable contexts and supports freezing mutable contexts into immutable contexts without copying.sha256ŽCast a Sha256Ctx to a Sha256State. This copies the first 32 bytes of the Sha256Ctx structure, so the result is always as small as possible.sha256ctx(, a pointer to a constant sha256 contextsha256'pointer to the constant data to processsha256length of the data to processsha2560output pointer, can be same as the input contextsha256ctx(, a pointer to a constant sha256 contextsha256'pointer to the constant data to processsha256length of the data to processsha256output pointersha256state0, a pointer to an constant array of eight Word32sha256'pointer to the constant data to processsha256length of the data to processsha256output pointersha256the new countsha256state0, a pointer to an constant array of eight Word32sha256 blockCount:, the number of blocks that a sha256 context has processedsha256'pointer to the constant data to processsha256length of the data to processsha256output pointer     (c) 2024 Auth GlobalApache2 Safe-Inferred"ËÝä æ$%&+-,.'()*/01234$%&+-,.'()*/01234  Safe-Inferred(äL5sha256³Halfway between an HmacKeyHashed and an HmacCtx. It's both an HmacKeyHashed that's gained a counter, and a HmacCtx that's guaranteed to contain no unprocessed input data.9sha256ÞA precomputed HMAC key. This structure is 64 bytes long, and consists of two SHA256 hashes.¡Computing an HMAC key typically costs two SHA256 blocks. No additional blocks are incurred for keys that are 64 bytes or less in length. Keys that are longer than 64 bytes long must be first hashed with SHA256 before the key can be derived, incurring extra block comptuations.•It is not uncommon that implementations of PBKDF2, HKDF, etc unnecessarily redo this computation even though a single HMAC key is used repeatedly.ÝTechnically these "hashes" are unfinished SHA-256 states, as the standard end-of-message padding has yet to be applied. Thus you can't compute these hashes using the most common command-line tools like sha256sum.µThe lack of end-of-message padding is also why precomputing HMAC keys on keys up to 64 bytes only requires one SHA-256 block computation for each of the two pads, whereas more typically the boundary for extra block computations happens between the 55th and 56th byte due to end-of-message padding.=sha256—Fixed-size context representing the state of a partial HMAC computation with a complete HMAC key and a partial message parameter. This maintains a buffer of up to 63 unprocessed bytes, so that you may feed it arbitrary bytestring without dealing with buffer boundaries.Asha256An  HmacKeyLike context can either be an E , or a 5.Esha256¢A cached, precomputed hmac key. It comes in two flavors, one that remembers the plaintext key, and one that doesn't, remembering only the precomputed hmac key.»Computing an hmac key typically requires two SHA256 blocks, unless the key itself is more than 64 bytes, in which case precomputing the key will require at least four SHA256 blocks.¿sha256ÏThis function can in theory return False, when converting both strings to a 9Ì first and then comparing returns True. However, probabilistically speaking, the recall of this function is cryptographically close to 1, and significantly faster than a full HMAC key derivation.ÔThere are three ways that a failure of recall, i.e. a false negative, can happen:ÕIf one key is 32 bytes or shorter, and the other is longer than 64 bytes, recall failures can happen if the SHA-256 hash of the longer key ends in at least 16 null bytes, corresponding to a partial preimage.åIf both keys are longer than 64 bytes, recall failures can happen when those keys collide SHA-256.ÒAlternatively, recall failures can happen when HMAC-SHA256's key schedule collides. This should be considerably more difficult than a regular SHA-256 collision, because it involves xor'ing each key with two different pads, and then hashing both. Thus, effectively, this requires two SHA-256 collisions of a very specific form.-57869;<:=@?>ADCBEGFHÀ¿IÁJKÂLMÃNOPQRSTUVWXYZ[\(c) 2024 Auth GlobalApache2 Safe-InferredÂ#EFGIJKLABCDPQRST9:<;UWVX5687[YZ=>?@#EFGIJKLABCDPQRST9:<;UWVX5687[YZ=>?@(c) 2024 Auth GlobalApache2 Safe-Inferred(ä% ^sha256åIf the plaintext hmac key has been remembered by the precomputed key, return it. Otherwise return Ä. Keys precomputed by ]Á retain the plaintext, which can subsequently be forgotten by _). Alternatively, keys precomputed by k7 never retains the plaintext key in the first place._sha256åForget any plaintext hmac keys being retained by a given precomputed key, meaning that for all x, 2hmacKey_toPlain (hmacKey_forgetPlain x) == Nothing.ÇThis is potentially useful when implementing PBKDF2, as the plaintext password can immediately be replaced with a precomputed hmac key, even before key-stretching is complete. Note that the precomputed hmac key does provide a fast brute-force attack on the plaintext key, typically as little as 1 SHA256 block, so this cannot be relied upon for secrecy if the hmac key is potentially guessable, such as a weak password or a non-secret salt.hsha256€how many bytes have been fed into the SHA256 state machine? This is always 64 more bytes than hmac's "message" input. If hmacKeyLike_toKey x == Just ..., then hmacKeyLike_byteCount x == 64. If hmacKeyLike_toKey x == NothingÈ, then this returns a multiple of 64 that is greater or equal to 128.ksha256íPrecompute an HmacKey without retaining the plaintext input, equivalent to 'hmacKey_forgetInput . hmacKey'{sha256½A simple interface to HMAC-SHA256. Note that this function was written to make partial application an efficient way to compute the hmac of multiple messages with exactly the same key: æ let myHash = hmac "my-key" in (myHash "message 1", myHash "message 2", myHash "message 3") œThis typically saves two SHA-256 blocks per reused function application. Thus this example saves four block computations from the two reused calls to myHash in this example.Initializing the myHash closure requires computing two SHA-256 blocks. Applying the closure requires two further SHA-256 blocks per message, as every message is less than 56 bytes long. Thus the total computation requires 8 SHA-256 blocks with reuse, or 12 SHA-256 blocks without reuse. Key reuse can save four or more block computations per application if the reused key is longer than 64 bytes. I don't recommend using HMAC keys that are longer than 64 bytes, as all such keys can be trivially replaced with the SHA256 hash of the key, which is only 32 bytes long./This high-level interface is implemented using „, o, and m× composed in a point-free style in order to help ensure key reuse works as expected.~sha256ÀInitialize a new empty HMAC context from a precomputed HMAC key.€sha256ÁAppend a bytestring onto the end of the message argument to HMAC.‚sha256ÐAppend zero or more bytestrings onto the end of the message argument to HMAC.„sha256 > ? @ A A B C D D E F G H I J K L M N O P Q R S T U V W X Y Z [ \ ] ^ _ ` a bcdefghijklmnopqrstuvwxyz{|}~€‚ƒ„…†‡ˆ‰Š‹ŒŽ‘’““”•–——˜™š›œžŸ ¡¢££¤¥¦§¨¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿À Á !  à ÄÅÆÇÈ%sha256-0.1.0.2-BtfTb451cqRKdC6SfPoEmfCrypto.Sha256.Subtle Crypto.Sha256Crypto.Sha256.Hmac.SubtleCrypto.Sha256.HmacCrypto.Sha256.Pbkdf2.SubtleCrypto.Sha256.Pbkdf2Crypto.Sha256.Hkdf.SubtleCrypto.Sha256.Hkdfsha256!Crypto.Sha256.Hmac.Implementation Sha256Ctx unSha256Ctx Sha256State unSha256State Sha256Ctx#MutableSha256Ctx# Sha256State#MutableSha256State#c_const_memcmp_ctxc_const_memcmp_uint32bec_sha256_decode_statec_sha256_encode_state"c_sha256_finalize_mutable_ctx_bitsc_sha256_finalize_ctx_bits_bac_sha256_finalize_ctx_bitsc_sha256_get_countc_sha256_mutate_ctxc_sha256_update_ctxc_sha256_updatec_sha256_promote_to_ctxc_sha256_init_ctx c_sha256_init nullBuffersha256state_initsha256state_feedsha256state_fromCtxInplacesha256state_fromCtxsha256state_runWithsha256state_encodesha256state_decode$fOrdSha256State$fEqSha256State$fOrdSha256Ctx $fEqSha256Ctxhashhash' sha256_initsha256_byteCountsha256_blockCountsha256_bufferLength sha256_state sha256_updatesha256_updates sha256_feed sha256_feedssha256_finalizesha256_finalize_toByteStringsha256_finalizeBits sha256_finalizeBits_toByteStringsha256_finalizeBytes!sha256_finalizeBytes_toByteStringHmacKeyPrefixedhmacKeyPrefixed_opadhmacKeyPrefixed_ipadCtx HmacKeyHashedhmacKeyHashed_opadhmacKeyHashed_ipadHmacCtx hmacCtx_opadhmacCtx_ipadCtx HmacKeyLikeHmacKeyLike_PlainHmacKeyLike_HashedHmacKeyLike_PrefixedHmacKey HmacKey_PlainHmacKey_Hashed HmacKeyPlain hmacKey_ipadhmacKey_ipadCtx hmacKey_opadhmacKey_opadCtxhmacKey_toHashedhmacKeyLike_toPrefixedhmacKeyPrefixed_initHashedhmacKeyLike_ipadCtxhmacKeyLike_opadhmacKeyLike_opadCtxhmacKeyLike_runIpadCtxhmacKeyLike_runOpadCtxhmacKeyHashed_ipadCtxhmacKeyHashed_runIpadCtxhmacKeyHashed_opadCtxhmacKeyHashed_runOpadCtxhmacKeyPrefixed_runIpadCtxhmacKeyPrefixed_runOpadCtxhmacKeyPrefixed_opadCtxhmacKeyPrefixed_blockCounthmacKeyhmacKey_toPlainhmacKey_forgetPlain hmacKeyLikehmacKeyLike_inithmacKeyLike_initHashedhmacKeyLike_initPrefixedhmacKeyLike_toPlainhmacKeyLike_toHashedhmacKeyLike_toKeyhmacKeyLike_runhmacKeyLike_byteCounthmacKeyLike_blockCounthmacKeyLike_bufferLengthhmacKey_hashed hmacKey_run hmacKeyHashedhmacKeyHashed_toKeyhmacKeyHashed_runhmacKeyHashed_runWithhmacKeyPrefixedhmacKeyPrefixed_inithmacKeyPrefixed_initLikehmacKeyPrefixed_toHashedhmacKeyPrefixed_feedhmacKeyPrefixed_feedshmacKeyPrefixed_feedsWithhmacKeyPrefixed_runhmacKeyPrefixed_byteCounthmacKeyPrefixed_bufferLengthhmachmac'hmacCtx hmacCtx_inithmacCtx_initWithhmacCtx_update hmacCtx_feedhmacCtx_updates hmacCtx_feedshmacCtx_finalizehmacCtx_finalizeBitshmacCtx_finalize_toByteString!hmacCtx_finalizeBits_toByteStringhmacCtx_finalizeBytes"hmacCtx_finalizeBytes_toByteStringhmacCtx_byteCounthmacCtx_blockCounthmacCtx_bufferLength Pbkdf2Genpbkdf2Gen_passwordpbkdf2Gen_finalizepbkdf2Gen_state Pbkdf2Ctxpbkdf2Ctx_passwordpbkdf2Ctx_ipadCtxpbkdf2 pbkdf2_indexpbkdf2Ctx_initpbkdf2Ctx_updatepbkdf2Ctx_updatespbkdf2Ctx_feedpbkdf2Ctx_feedspbkdf2Ctx_finalizepbkdf2Gen_iterateHkdfGen hkdfGen_info hkdfGen_keyhkdfGen_counter hkdfGen_stateHkdfCtxhkdfCtx_hmacCtx $fEqHkdfCtx $fOrdHkdfCtxhkdfhkdf'hkdfList hkdfList'hkdfGen hkdfExtract hkdfExpand hkdfExpand'hkdfExpandListhkdfExpandList' hkdfExpandGen hkdfCtx_init hkdfCtx_feeds hkdfCtx_feedhkdfCtx_updateshkdfCtx_updatehkdfCtx_finalize hkdfGen_init hkdfGen_read' hkdfGen_read hkdfGen_peekhmacKeyPlain_eqhmacKey_runIpadCtxhmacKey_runOpadCtxhmacKeyPrefixed_eqHashedbase GHC.MaybeNothing