@blockcast/mmt-container 0.1.0-main.149f78a4adae

package/node_modules/@noble/hashes/src/blake3.ts

@@ -0,0 +1,272 @@
+/**
+ * Blake3 fast hash is Blake2 with reduced security (round count). Can also be used as MAC & KDF.
+ *
+ * It is advertised as "the fastest cryptographic hash". However, it isn't true in JS.
+ * Why is this so slow? While it should be 6x faster than blake2b, perf diff is only 20%:
+ *
+ * * There is only 30% reduction in number of rounds from blake2s
+ * * Speed-up comes from tree structure, which is parallelized using SIMD & threading.
+ *   These features are not present in JS, so we only get overhead from trees.
+ * * Parallelization only happens on 1024-byte chunks: there is no benefit for small inputs.
+ * * It is still possible to make it faster using: a) loop unrolling b) web workers c) wasm
+ * @module
+ */
+import { SHA256_IV } from './_md.ts';
+import { fromBig } from './_u64.ts';
+import { BLAKE2, compress } from './blake2.ts';
+// prettier-ignore
+import {
+  abytes, aexists, anumber, aoutput,
+  clean, createXOFer, swap32IfBE, toBytes, u32, u8,
+  type CHashXO, type HashXOF, type Input
+} from './utils.ts';
+
+// Flag bitset
+const B3_Flags = {
+  CHUNK_START: 0b1,
+  CHUNK_END: 0b10,
+  PARENT: 0b100,
+  ROOT: 0b1000,
+  KEYED_HASH: 0b10000,
+  DERIVE_KEY_CONTEXT: 0b100000,
+  DERIVE_KEY_MATERIAL: 0b1000000,
+} as const;
+
+const B3_IV = SHA256_IV.slice();
+
+const B3_SIGMA: Uint8Array = /* @__PURE__ */ (() => {
+  const Id = Array.from({ length: 16 }, (_, i) => i);
+  const permute = (arr: number[]) =>
+    [2, 6, 3, 10, 7, 0, 4, 13, 1, 11, 12, 5, 9, 14, 15, 8].map((i) => arr[i]);
+  const res: number[] = [];
+  for (let i = 0, v = Id; i < 7; i++, v = permute(v)) res.push(...v);
+  return Uint8Array.from(res);
+})();
+
+/**
+ * Ensure to use EITHER `key` OR `context`, not both.
+ *
+ * * `key`: 32-byte MAC key.
+ * * `context`: string for KDF. Should be hardcoded, globally unique, and application - specific.
+ *   A good default format for the context string is "[application] [commit timestamp] [purpose]".
+ */
+export type Blake3Opts = { dkLen?: number; key?: Input; context?: Input };
+
+/** Blake3 hash. Can be used as MAC and KDF. */
+export class BLAKE3 extends BLAKE2<BLAKE3> implements HashXOF<BLAKE3> {
+  private chunkPos = 0; // Position of current block in chunk
+  private chunksDone = 0; // How many chunks we already have
+  private flags = 0 | 0;
+  private IV: Uint32Array;
+  private state: Uint32Array;
+  private stack: Uint32Array[] = [];
+  // Output
+  private posOut = 0;
+  private bufferOut32 = new Uint32Array(16);
+  private bufferOut: Uint8Array;
+  private chunkOut = 0; // index of output chunk
+  private enableXOF = true;
+
+  constructor(opts: Blake3Opts = {}, flags = 0) {
+    super(64, opts.dkLen === undefined ? 32 : opts.dkLen);
+    const { key, context } = opts;
+    const hasContext = context !== undefined;
+    if (key !== undefined) {
+      if (hasContext) throw new Error('Only "key" or "context" can be specified at same time');
+      const k = toBytes(key).slice();
+      abytes(k, 32);
+      this.IV = u32(k);
+      swap32IfBE(this.IV);
+      this.flags = flags | B3_Flags.KEYED_HASH;
+    } else if (hasContext) {
+      const ctx = toBytes(context);
+      const contextKey = new BLAKE3({ dkLen: 32 }, B3_Flags.DERIVE_KEY_CONTEXT)
+        .update(ctx)
+        .digest();
+      this.IV = u32(contextKey);
+      swap32IfBE(this.IV);
+      this.flags = flags | B3_Flags.DERIVE_KEY_MATERIAL;
+    } else {
+      this.IV = B3_IV.slice();
+      this.flags = flags;
+    }
+    this.state = this.IV.slice();
+    this.bufferOut = u8(this.bufferOut32);
+  }
+  // Unused
+  protected get(): [] {
+    return [];
+  }
+  protected set(): void {}
+  private b2Compress(counter: number, flags: number, buf: Uint32Array, bufPos: number = 0) {
+    const { state: s, pos } = this;
+    const { h, l } = fromBig(BigInt(counter), true);
+    // prettier-ignore
+    const { v0, v1, v2, v3, v4, v5, v6, v7, v8, v9, v10, v11, v12, v13, v14, v15 } =
+      compress(
+        B3_SIGMA, bufPos, buf, 7,
+        s[0], s[1], s[2], s[3], s[4], s[5], s[6], s[7],
+        B3_IV[0], B3_IV[1], B3_IV[2], B3_IV[3], h, l, pos, flags
+      );
+    s[0] = v0 ^ v8;
+    s[1] = v1 ^ v9;
+    s[2] = v2 ^ v10;
+    s[3] = v3 ^ v11;
+    s[4] = v4 ^ v12;
+    s[5] = v5 ^ v13;
+    s[6] = v6 ^ v14;
+    s[7] = v7 ^ v15;
+  }
+  protected compress(buf: Uint32Array, bufPos: number = 0, isLast: boolean = false): void {
+    // Compress last block
+    let flags = this.flags;
+    if (!this.chunkPos) flags |= B3_Flags.CHUNK_START;
+    if (this.chunkPos === 15 || isLast) flags |= B3_Flags.CHUNK_END;
+    if (!isLast) this.pos = this.blockLen;
+    this.b2Compress(this.chunksDone, flags, buf, bufPos);
+    this.chunkPos += 1;
+    // If current block is last in chunk (16 blocks), then compress chunks
+    if (this.chunkPos === 16 || isLast) {
+      let chunk = this.state;
+      this.state = this.IV.slice();
+      // If not the last one, compress only when there are trailing zeros in chunk counter
+      // chunks used as binary tree where current stack is path. Zero means current leaf is finished and can be compressed.
+      // 1 (001) - leaf not finished (just push current chunk to stack)
+      // 2 (010) - leaf finished at depth=1 (merge with last elm on stack and push back)
+      // 3 (011) - last leaf not finished
+      // 4 (100) - leafs finished at depth=1 and depth=2
+      for (let last, chunks = this.chunksDone + 1; isLast || !(chunks & 1); chunks >>= 1) {
+        if (!(last = this.stack.pop())) break;
+        this.buffer32.set(last, 0);
+        this.buffer32.set(chunk, 8);
+        this.pos = this.blockLen;
+        this.b2Compress(0, this.flags | B3_Flags.PARENT, this.buffer32, 0);
+        chunk = this.state;
+        this.state = this.IV.slice();
+      }
+      this.chunksDone++;
+      this.chunkPos = 0;
+      this.stack.push(chunk);
+    }
+    this.pos = 0;
+  }
+  _cloneInto(to?: BLAKE3): BLAKE3 {
+    to = super._cloneInto(to) as BLAKE3;
+    const { IV, flags, state, chunkPos, posOut, chunkOut, stack, chunksDone } = this;
+    to.state.set(state.slice());
+    to.stack = stack.map((i) => Uint32Array.from(i));
+    to.IV.set(IV);
+    to.flags = flags;
+    to.chunkPos = chunkPos;
+    to.chunksDone = chunksDone;
+    to.posOut = posOut;
+    to.chunkOut = chunkOut;
+    to.enableXOF = this.enableXOF;
+    to.bufferOut32.set(this.bufferOut32);
+    return to;
+  }
+  destroy(): void {
+    this.destroyed = true;
+    clean(this.state, this.buffer32, this.IV, this.bufferOut32);
+    clean(...this.stack);
+  }
+  // Same as b2Compress, but doesn't modify state and returns 16 u32 array (instead of 8)
+  private b2CompressOut() {
+    const { state: s, pos, flags, buffer32, bufferOut32: out32 } = this;
+    const { h, l } = fromBig(BigInt(this.chunkOut++));
+    swap32IfBE(buffer32);
+    // prettier-ignore
+    const { v0, v1, v2, v3, v4, v5, v6, v7, v8, v9, v10, v11, v12, v13, v14, v15 } =
+      compress(
+        B3_SIGMA, 0, buffer32, 7,
+        s[0], s[1], s[2], s[3], s[4], s[5], s[6], s[7],
+        B3_IV[0], B3_IV[1], B3_IV[2], B3_IV[3], l, h, pos, flags
+      );
+    out32[0] = v0 ^ v8;
+    out32[1] = v1 ^ v9;
+    out32[2] = v2 ^ v10;
+    out32[3] = v3 ^ v11;
+    out32[4] = v4 ^ v12;
+    out32[5] = v5 ^ v13;
+    out32[6] = v6 ^ v14;
+    out32[7] = v7 ^ v15;
+    out32[8] = s[0] ^ v8;
+    out32[9] = s[1] ^ v9;
+    out32[10] = s[2] ^ v10;
+    out32[11] = s[3] ^ v11;
+    out32[12] = s[4] ^ v12;
+    out32[13] = s[5] ^ v13;
+    out32[14] = s[6] ^ v14;
+    out32[15] = s[7] ^ v15;
+    swap32IfBE(buffer32);
+    swap32IfBE(out32);
+    this.posOut = 0;
+  }
+  protected finish(): void {
+    if (this.finished) return;
+    this.finished = true;
+    // Padding
+    clean(this.buffer.subarray(this.pos));
+    // Process last chunk
+    let flags = this.flags | B3_Flags.ROOT;
+    if (this.stack.length) {
+      flags |= B3_Flags.PARENT;
+      swap32IfBE(this.buffer32);
+      this.compress(this.buffer32, 0, true);
+      swap32IfBE(this.buffer32);
+      this.chunksDone = 0;
+      this.pos = this.blockLen;
+    } else {
+      flags |= (!this.chunkPos ? B3_Flags.CHUNK_START : 0) | B3_Flags.CHUNK_END;
+    }
+    this.flags = flags;
+    this.b2CompressOut();
+  }
+  private writeInto(out: Uint8Array) {
+    aexists(this, false);
+    abytes(out);
+    this.finish();
+    const { blockLen, bufferOut } = this;
+    for (let pos = 0, len = out.length; pos < len; ) {
+      if (this.posOut >= blockLen) this.b2CompressOut();
+      const take = Math.min(blockLen - this.posOut, len - pos);
+      out.set(bufferOut.subarray(this.posOut, this.posOut + take), pos);
+      this.posOut += take;
+      pos += take;
+    }
+    return out;
+  }
+  xofInto(out: Uint8Array): Uint8Array {
+    if (!this.enableXOF) throw new Error('XOF is not possible after digest call');
+    return this.writeInto(out);
+  }
+  xof(bytes: number): Uint8Array {
+    anumber(bytes);
+    return this.xofInto(new Uint8Array(bytes));
+  }
+  digestInto(out: Uint8Array): Uint8Array {
+    aoutput(out, this);
+    if (this.finished) throw new Error('digest() was already called');
+    this.enableXOF = false;
+    this.writeInto(out);
+    this.destroy();
+    return out;
+  }
+  digest(): Uint8Array {
+    return this.digestInto(new Uint8Array(this.outputLen));
+  }
+}
+
+/**
+ * BLAKE3 hash function. Can be used as MAC and KDF.
+ * @param msg - message that would be hashed
+ * @param opts - `dkLen` for output length, `key` for MAC mode, `context` for KDF mode
+ * @example
+ * const data = new Uint8Array(32);
+ * const hash = blake3(data);
+ * const mac = blake3(data, { key: new Uint8Array(32) });
+ * const kdf = blake3(data, { context: 'application name' });
+ */
+export const blake3: CHashXO = /* @__PURE__ */ createXOFer<BLAKE3, Blake3Opts>(
+  (opts) => new BLAKE3(opts)
+);

package/node_modules/@noble/hashes/src/crypto.ts

@@ -0,0 +1,9 @@
+/**
+ * Internal webcrypto alias.
+ * We use WebCrypto aka globalThis.crypto, which exists in browsers and node.js 16+.
+ * See utils.ts for details.
+ * @module
+ */
+declare const globalThis: Record<string, any> | undefined;
+export const crypto: any =
+  typeof globalThis === 'object' && 'crypto' in globalThis ? globalThis.crypto : undefined;

package/node_modules/@noble/hashes/src/cryptoNode.ts

@@ -0,0 +1,15 @@
+/**
+ * Internal webcrypto alias.
+ * We prefer WebCrypto aka globalThis.crypto, which exists in node.js 16+.
+ * Falls back to Node.js built-in crypto for Node.js <=v14.
+ * See utils.ts for details.
+ * @module
+ */
+// @ts-ignore
+import * as nc from 'node:crypto';
+export const crypto: any =
+  nc && typeof nc === 'object' && 'webcrypto' in nc
+    ? (nc.webcrypto as any)
+    : nc && typeof nc === 'object' && 'randomBytes' in nc
+      ? nc
+      : undefined;

package/node_modules/@noble/hashes/src/eskdf.ts

@@ -0,0 +1,187 @@
+/**
+ * Experimental KDF for AES.
+ */
+import { hkdf } from './hkdf.ts';
+import { pbkdf2 as _pbkdf2 } from './pbkdf2.ts';
+import { scrypt as _scrypt } from './scrypt.ts';
+import { sha256 } from './sha256.ts';
+import { abytes, bytesToHex, clean, createView, hexToBytes, kdfInputToBytes } from './utils.ts';
+
+// A tiny KDF for various applications like AES key-gen.
+// Uses HKDF in a non-standard way, so it's not "KDF-secure", only "PRF-secure".
+// Which is good enough: assume sha2-256 retained preimage resistance.
+
+const SCRYPT_FACTOR = 2 ** 19;
+const PBKDF2_FACTOR = 2 ** 17;
+
+// Scrypt KDF
+export function scrypt(password: string, salt: string): Uint8Array {
+  return _scrypt(password, salt, { N: SCRYPT_FACTOR, r: 8, p: 1, dkLen: 32 });
+}
+
+// PBKDF2-HMAC-SHA256
+export function pbkdf2(password: string, salt: string): Uint8Array {
+  return _pbkdf2(sha256, password, salt, { c: PBKDF2_FACTOR, dkLen: 32 });
+}
+
+// Combines two 32-byte byte arrays
+function xor32(a: Uint8Array, b: Uint8Array): Uint8Array {
+  abytes(a, 32);
+  abytes(b, 32);
+  const arr = new Uint8Array(32);
+  for (let i = 0; i < 32; i++) {
+    arr[i] = a[i] ^ b[i];
+  }
+  return arr;
+}
+
+function strHasLength(str: string, min: number, max: number): boolean {
+  return typeof str === 'string' && str.length >= min && str.length <= max;
+}
+
+/**
+ * Derives main seed. Takes a lot of time. Prefer `eskdf` method instead.
+ */
+export function deriveMainSeed(username: string, password: string): Uint8Array {
+  if (!strHasLength(username, 8, 255)) throw new Error('invalid username');
+  if (!strHasLength(password, 8, 255)) throw new Error('invalid password');
+  // Declared like this to throw off minifiers which auto-convert .fromCharCode(1) to actual string.
+  // String with non-ascii may be problematic in some envs
+  const codes = { _1: 1, _2: 2 };
+  const sep = { s: String.fromCharCode(codes._1), p: String.fromCharCode(codes._2) };
+  const scr = scrypt(password + sep.s, username + sep.s);
+  const pbk = pbkdf2(password + sep.p, username + sep.p);
+  const res = xor32(scr, pbk);
+  clean(scr, pbk);
+  return res;
+}
+
+type AccountID = number | string;
+
+/**
+ * Converts protocol & accountId pair to HKDF salt & info params.
+ */
+function getSaltInfo(protocol: string, accountId: AccountID = 0) {
+  // Note that length here also repeats two lines below
+  // We do an additional length check here to reduce the scope of DoS attacks
+  if (!(strHasLength(protocol, 3, 15) && /^[a-z0-9]{3,15}$/.test(protocol))) {
+    throw new Error('invalid protocol');
+  }
+
+  // Allow string account ids for some protocols
+  const allowsStr = /^password\d{0,3}|ssh|tor|file$/.test(protocol);
+  let salt: Uint8Array; // Extract salt. Default is undefined.
+  if (typeof accountId === 'string') {
+    if (!allowsStr) throw new Error('accountId must be a number');
+    if (!strHasLength(accountId, 1, 255))
+      throw new Error('accountId must be string of length 1..255');
+    salt = kdfInputToBytes(accountId);
+  } else if (Number.isSafeInteger(accountId)) {
+    if (accountId < 0 || accountId > Math.pow(2, 32) - 1) throw new Error('invalid accountId');
+    // Convert to Big Endian Uint32
+    salt = new Uint8Array(4);
+    createView(salt).setUint32(0, accountId, false);
+  } else {
+    throw new Error('accountId must be a number' + (allowsStr ? ' or string' : ''));
+  }
+  const info = kdfInputToBytes(protocol);
+  return { salt, info };
+}
+
+type OptsLength = { keyLength: number };
+type OptsMod = { modulus: bigint };
+type KeyOpts = undefined | OptsLength | OptsMod;
+
+function countBytes(num: bigint): number {
+  if (typeof num !== 'bigint' || num <= BigInt(128)) throw new Error('invalid number');
+  return Math.ceil(num.toString(2).length / 8);
+}
+
+/**
+ * Parses keyLength and modulus options to extract length of result key.
+ * If modulus is used, adds 64 bits to it as per FIPS 186 B.4.1 to combat modulo bias.
+ */
+function getKeyLength(options: KeyOpts): number {
+  if (!options || typeof options !== 'object') return 32;
+  const hasLen = 'keyLength' in options;
+  const hasMod = 'modulus' in options;
+  if (hasLen && hasMod) throw new Error('cannot combine keyLength and modulus options');
+  if (!hasLen && !hasMod) throw new Error('must have either keyLength or modulus option');
+  // FIPS 186 B.4.1 requires at least 64 more bits
+  const l = hasMod ? countBytes(options.modulus) + 8 : options.keyLength;
+  if (!(typeof l === 'number' && l >= 16 && l <= 8192)) throw new Error('invalid keyLength');
+  return l;
+}
+
+/**
+ * Converts key to bigint and divides it by modulus. Big Endian.
+ * Implements FIPS 186 B.4.1, which removes 0 and modulo bias from output.
+ */
+function modReduceKey(key: Uint8Array, modulus: bigint): Uint8Array {
+  const _1 = BigInt(1);
+  const num = BigInt('0x' + bytesToHex(key)); // check for ui8a, then bytesToNumber()
+  const res = (num % (modulus - _1)) + _1; // Remove 0 from output
+  if (res < _1) throw new Error('expected positive number'); // Guard against bad values
+  const len = key.length - 8; // FIPS requires 64 more bits = 8 bytes
+  const hex = res.toString(16).padStart(len * 2, '0'); // numberToHex()
+  const bytes = hexToBytes(hex);
+  if (bytes.length !== len) throw new Error('invalid length of result key');
+  return bytes;
+}
+
+// We are not using classes because constructor cannot be async
+export interface ESKDF {
+  /**
+   * Derives a child key. Child key will not be associated with any
+   * other child key because of properties of underlying KDF.
+   *
+   * @param protocol - 3-15 character protocol name
+   * @param accountId - numeric identifier of account
+   * @param options - `keyLength: 64` or `modulus: 41920438n`
+   * @example deriveChildKey('aes', 0)
+   */
+  deriveChildKey: (protocol: string, accountId: AccountID, options?: KeyOpts) => Uint8Array;
+  /**
+   * Deletes the main seed from eskdf instance
+   */
+  expire: () => void;
+  /**
+   * Account fingerprint
+   */
+  fingerprint: string;
+}
+
+/**
+ * ESKDF
+ * @param username - username, email, or identifier, min: 8 characters, should have enough entropy
+ * @param password - password, min: 8 characters, should have enough entropy
+ * @example
+ * const kdf = await eskdf('example-university', 'beginning-new-example');
+ * const key = kdf.deriveChildKey('aes', 0);
+ * console.log(kdf.fingerprint);
+ * kdf.expire();
+ */
+export async function eskdf(username: string, password: string): Promise<ESKDF> {
+  // We are using closure + object instead of class because
+  // we want to make `seed` non-accessible for any external function.
+  let seed: Uint8Array | undefined = deriveMainSeed(username, password);
+
+  function deriveCK(protocol: string, accountId: AccountID = 0, options?: KeyOpts): Uint8Array {
+    abytes(seed, 32);
+    const { salt, info } = getSaltInfo(protocol, accountId); // validate protocol & accountId
+    const keyLength = getKeyLength(options); // validate options
+    const key = hkdf(sha256, seed!, salt, info, keyLength);
+    // Modulus has already been validated
+    return options && 'modulus' in options ? modReduceKey(key, options.modulus) : key;
+  }
+  function expire() {
+    if (seed) seed.fill(1);
+    seed = undefined;
+  }
+  // prettier-ignore
+  const fingerprint = Array.from(deriveCK('fingerprint', 0))
+    .slice(0, 6)
+    .map((char) => char.toString(16).padStart(2, '0').toUpperCase())
+    .join(':');
+  return Object.freeze({ deriveChildKey: deriveCK, expire, fingerprint });
+}

package/node_modules/@noble/hashes/src/hkdf.ts

@@ -0,0 +1,88 @@
+/**
+ * HKDF (RFC 5869): extract + expand in one step.
+ * See https://soatok.blog/2021/11/17/understanding-hkdf/.
+ * @module
+ */
+import { hmac } from './hmac.ts';
+import { ahash, anumber, type CHash, clean, type Input, toBytes } from './utils.ts';
+
+/**
+ * HKDF-extract from spec. Less important part. `HKDF-Extract(IKM, salt) -> PRK`
+ * Arguments position differs from spec (IKM is first one, since it is not optional)
+ * @param hash - hash function that would be used (e.g. sha256)
+ * @param ikm - input keying material, the initial key
+ * @param salt - optional salt value (a non-secret random value)
+ */
+export function extract(hash: CHash, ikm: Input, salt?: Input): Uint8Array {
+  ahash(hash);
+  // NOTE: some libraries treat zero-length array as 'not provided';
+  // we don't, since we have undefined as 'not provided'
+  // https://github.com/RustCrypto/KDFs/issues/15
+  if (salt === undefined) salt = new Uint8Array(hash.outputLen);
+  return hmac(hash, toBytes(salt), toBytes(ikm));
+}
+
+const HKDF_COUNTER = /* @__PURE__ */ Uint8Array.from([0]);
+const EMPTY_BUFFER = /* @__PURE__ */ Uint8Array.of();
+
+/**
+ * HKDF-expand from the spec. The most important part. `HKDF-Expand(PRK, info, L) -> OKM`
+ * @param hash - hash function that would be used (e.g. sha256)
+ * @param prk - a pseudorandom key of at least HashLen octets (usually, the output from the extract step)
+ * @param info - optional context and application specific information (can be a zero-length string)
+ * @param length - length of output keying material in bytes
+ */
+export function expand(hash: CHash, prk: Input, info?: Input, length: number = 32): Uint8Array {
+  ahash(hash);
+  anumber(length);
+  const olen = hash.outputLen;
+  if (length > 255 * olen) throw new Error('Length should be <= 255*HashLen');
+  const blocks = Math.ceil(length / olen);
+  if (info === undefined) info = EMPTY_BUFFER;
+  // first L(ength) octets of T
+  const okm = new Uint8Array(blocks * olen);
+  // Re-use HMAC instance between blocks
+  const HMAC = hmac.create(hash, prk);
+  const HMACTmp = HMAC._cloneInto();
+  const T = new Uint8Array(HMAC.outputLen);
+  for (let counter = 0; counter < blocks; counter++) {
+    HKDF_COUNTER[0] = counter + 1;
+    // T(0) = empty string (zero length)
+    // T(N) = HMAC-Hash(PRK, T(N-1) | info | N)
+    HMACTmp.update(counter === 0 ? EMPTY_BUFFER : T)
+      .update(info)
+      .update(HKDF_COUNTER)
+      .digestInto(T);
+    okm.set(T, olen * counter);
+    HMAC._cloneInto(HMACTmp);
+  }
+  HMAC.destroy();
+  HMACTmp.destroy();
+  clean(T, HKDF_COUNTER);
+  return okm.slice(0, length);
+}
+
+/**
+ * HKDF (RFC 5869): derive keys from an initial input.
+ * Combines hkdf_extract + hkdf_expand in one step
+ * @param hash - hash function that would be used (e.g. sha256)
+ * @param ikm - input keying material, the initial key
+ * @param salt - optional salt value (a non-secret random value)
+ * @param info - optional context and application specific information (can be a zero-length string)
+ * @param length - length of output keying material in bytes
+ * @example
+ * import { hkdf } from '@noble/hashes/hkdf';
+ * import { sha256 } from '@noble/hashes/sha2';
+ * import { randomBytes } from '@noble/hashes/utils';
+ * const inputKey = randomBytes(32);
+ * const salt = randomBytes(32);
+ * const info = 'application-key';
+ * const hk1 = hkdf(sha256, inputKey, salt, info, 32);
+ */
+export const hkdf = (
+  hash: CHash,
+  ikm: Input,
+  salt: Input | undefined,
+  info: Input | undefined,
+  length: number
+): Uint8Array => expand(hash, extract(hash, ikm, salt), info, length);

package/node_modules/@noble/hashes/src/hmac.ts

@@ -0,0 +1,94 @@
+/**
+ * HMAC: RFC2104 message authentication code.
+ * @module
+ */
+import { abytes, aexists, ahash, clean, Hash, toBytes, type CHash, type Input } from './utils.ts';
+
+export class HMAC<T extends Hash<T>> extends Hash<HMAC<T>> {
+  oHash: T;
+  iHash: T;
+  blockLen: number;
+  outputLen: number;
+  private finished = false;
+  private destroyed = false;
+
+  constructor(hash: CHash, _key: Input) {
+    super();
+    ahash(hash);
+    const key = toBytes(_key);
+    this.iHash = hash.create() as T;
+    if (typeof this.iHash.update !== 'function')
+      throw new Error('Expected instance of class which extends utils.Hash');
+    this.blockLen = this.iHash.blockLen;
+    this.outputLen = this.iHash.outputLen;
+    const blockLen = this.blockLen;
+    const pad = new Uint8Array(blockLen);
+    // blockLen can be bigger than outputLen
+    pad.set(key.length > blockLen ? hash.create().update(key).digest() : key);
+    for (let i = 0; i < pad.length; i++) pad[i] ^= 0x36;
+    this.iHash.update(pad);
+    // By doing update (processing of first block) of outer hash here we can re-use it between multiple calls via clone
+    this.oHash = hash.create() as T;
+    // Undo internal XOR && apply outer XOR
+    for (let i = 0; i < pad.length; i++) pad[i] ^= 0x36 ^ 0x5c;
+    this.oHash.update(pad);
+    clean(pad);
+  }
+  update(buf: Input): this {
+    aexists(this);
+    this.iHash.update(buf);
+    return this;
+  }
+  digestInto(out: Uint8Array): void {
+    aexists(this);
+    abytes(out, this.outputLen);
+    this.finished = true;
+    this.iHash.digestInto(out);
+    this.oHash.update(out);
+    this.oHash.digestInto(out);
+    this.destroy();
+  }
+  digest(): Uint8Array {
+    const out = new Uint8Array(this.oHash.outputLen);
+    this.digestInto(out);
+    return out;
+  }
+  _cloneInto(to?: HMAC<T>): HMAC<T> {
+    // Create new instance without calling constructor since key already in state and we don't know it.
+    to ||= Object.create(Object.getPrototypeOf(this), {});
+    const { oHash, iHash, finished, destroyed, blockLen, outputLen } = this;
+    to = to as this;
+    to.finished = finished;
+    to.destroyed = destroyed;
+    to.blockLen = blockLen;
+    to.outputLen = outputLen;
+    to.oHash = oHash._cloneInto(to.oHash);
+    to.iHash = iHash._cloneInto(to.iHash);
+    return to;
+  }
+  clone(): HMAC<T> {
+    return this._cloneInto();
+  }
+  destroy(): void {
+    this.destroyed = true;
+    this.oHash.destroy();
+    this.iHash.destroy();
+  }
+}
+
+/**
+ * HMAC: RFC2104 message authentication code.
+ * @param hash - function that would be used e.g. sha256
+ * @param key - message key
+ * @param message - message data
+ * @example
+ * import { hmac } from '@noble/hashes/hmac';
+ * import { sha256 } from '@noble/hashes/sha2';
+ * const mac1 = hmac(sha256, 'key', 'message');
+ */
+export const hmac: {
+  (hash: CHash, key: Input, message: Input): Uint8Array;
+  create(hash: CHash, key: Input): HMAC<any>;
+} = (hash: CHash, key: Input, message: Input): Uint8Array =>
+  new HMAC<any>(hash, key).update(message).digest();
+hmac.create = (hash: CHash, key: Input) => new HMAC<any>(hash, key);