21 lines
561 B
Go
21 lines
561 B
Go
|
package auth
|
||
|
|
|
||
|
|
import (
|
||
|
|
"crypto/hmac"
|
||
|
|
"crypto/sha256"
|
||
|
|
)
|
||
|
|
|
||
|
|
// sha256HMAC computes an HMAC-SHA256 tag.
|
||
|
|
//
|
||
|
|
// It is a thin wrapper so that the session store and the OIDC state store
|
||
|
|
// cannot accidentally diverge on how they sign. The stdlib hmac package already
|
||
|
|
// performs a constant-time internal comparison; the constant-time requirement
|
||
|
|
// in this codebase is about how *we* compare the resulting tags.
|
||
|
|
func sha256HMAC(key, body []byte) [32]byte {
|
||
|
|
mac := hmac.New(sha256.New, key)
|
||
|
|
mac.Write(body)
|
||
|
|
var out [32]byte
|
||
|
|
copy(out[:], mac.Sum(nil))
|
||
|
|
return out
|
||
|
|
}
|