otp_crypto/sha256_hmac library

OTP Crypto – HMAC-SHA256 (pure Dart impl using SHA-256 from crypto)

Implements HMAC(SHA-256) per RFC 2104 / FIPS 198-1 with a 64-byte block size. We only depend on the SHA-256 digest from package:crypto, while the HMAC construction (ipad/opad, key normalization, concatenation) is written here.

SECURITY NOTES:

  • Keys longer than the block size (64) are first hashed with SHA-256, then zero-padded up to 64 bytes (K0).
  • HMAC output length is 32 bytes for SHA-256.
  • Prefer Bytes.constantTimeEquals when comparing tags.

HINTS:

  • Use compute(key, [...]) to MAC multiple parts without extra copies.
  • Avoid converting to strings; operate on bytes (Uint8List) end-to-end.

Classes

HmacSha256