What the developer wrote
Authored by Liam Aharon
hashes: Test hmac incremental input
Issue https://github.com/rust-bitcoin/rust-bitcoin/issues/5601 flagged
sha3-256 did not test or handle incremental input correctly.
While correcting sha3-256 behavior in PR #5604, an audit of all hashing
algorithms was undertaken to check they handle and test incremental
input correctly.
All algorithms passed, except hmac which handled incremental input
correctly but did not test it.
Extends the hmac hashing test suite with incremental input cases.
What changed, and why it matters
This commit only adds a new test to verify that HMAC hashing still produces the correct result when data is fed in one byte at a time. It does not change any production code, fix a bug, or alter behavior. The existing code already handled incremental input correctly; the change simply adds missing test coverage.
No security action needed. Treat as routine test-coverage improvement.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The diff extends the HMAC test module in hashes/src/hmac/mod.rs by adding an additional loop that feeds each byte of the test input individually to an HmacEngine and then checks the final hash matches the expected output. No implementation code was modified. The commit message notes that an audit found all algorithms handle incremental input correctly and that HMAC merely lacked a test for it.
Changed components
hashes/src/hmac/mod.rs (test module only)Inspect captured patch +8 / −0
diff --git a/hashes/src/hmac/mod.rs b/hashes/src/hmac/mod.rs
index dc96379f..31115011 100644
--- a/hashes/src/hmac/mod.rs
+++ b/hashes/src/hmac/mod.rs
@@ -276,6 +276,14 @@ mod tests {
let hash = engine.finalize();
assert_eq!(hash.as_ref(), test.output);
assert_eq!(hash.to_byte_array(), test.output);
+
+ // Hash through engine, checking that we can input byte by byte
+ let mut engine = HmacEngine::<sha256::HashEngine>::new(test.key);
+ for ch in test.input {
+ engine.input(&[*ch]);
+ }
+ let hash = engine.finalize();
+ assert_eq!(hash.to_byte_array(), test.output);
}
}
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.