@noble/hashes 1.4.0: hmac

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify hmac in pkg:npm/%40noble/hashes@1.4.0
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:npm/%40noble/hashes@1.4.0
Demonstrate these symbols/APIs:
  - hmac

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:4d33d7ce3284dd2383ef78291a15bf8290824e7adacbd4f6cd3df5b06cf8b520","contract":["assert HMAC with SHA-256 computes expected message authentication code for RFC 4231 standard test vectors","assert HMAC with SHA-512 generates valid 512-bit authentication digest","assert HMAC handles keys larger than hash block size by hashing the key first","assert streaming HMAC with hmac.create and incremental update matches one-shot computation","assert direct hmac invocation returns 32-byte Uint8Array digest"],"goal":"verify hmac in pkg:npm/%40noble/hashes@1.4.0","kind":"HOW","packages":["pkg:npm/%40noble/hashes@1.4.0"],"schemaVersion":1,"symbols":["hmac"]},"contractCommand":["node","test/contract.mjs"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"npm","executionContext":"node","language":"javascript","libc":"glibc","libcVersion":"2.39","moduleSystem":"cjs","os":"linux","osVersionBucket":"24","packageManager":"npm","packageManagerVersion":"10.9.8","runtime":"node","runtimeVersion":"22.23.2","schemaVersion":1},"license":"MIT-0","packages":["pkg:npm/%40noble/hashes@1.4.0"],"schemaVersion":1,"subject":"pkg:npm/%40noble/hashes@1.4.0","symbols":["hmac"],"verifierAdapter":"node-typescript@1"}

const { hmac, HMAC } = require('@noble/hashes/hmac');
const { sha256 } = require('@noble/hashes/sha256');
const { sha512 } = require('@noble/hashes/sha512');
const { sha3_256 } = require('@noble/hashes/sha3');
const { bytesToHex, hexToBytes, utf8ToBytes } = require('@noble/hashes/utils');

function toBytes(data) {
  if (typeof data === 'string') return utf8ToBytes(data);
  return data;
}

function computeHmac(hashFn, key, message) {
  const keyBytes = toBytes(key);
  const msgBytes = toBytes(message);
  return bytesToHex(hmac(hashFn, keyBytes, msgBytes));
}

function createHmacStream(hashFn, key) {
  const keyBytes = toBytes(key);
  const instance = hmac.create(hashFn, keyBytes);
  return {
    update(chunk) {
      instance.update(toBytes(chunk));
      return this;
    },
    digest() {
      return bytesToHex(instance.digest());
    },
    digestBytes() {
      return instance.digest();
    }
  };
}

module.exports = {
  hmac,
  HMAC,
  sha256,
  sha512,
  sha3_256,
  computeHmac,
  createHmacStream,
  bytesToHex,
  hexToBytes,
  utf8ToBytes,
  toBytes,
};

{
  "name": "sample-noble-hashes-hmac",
  "version": "1.0.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "sample-noble-hashes-hmac",
      "version": "1.0.0",
      "license": "MIT-0",
      "dependencies": {
        "@noble/hashes": "1.4.0"
      }
    },
    "node_modules/@noble/hashes": {
      "version": "1.4.0",
      "resolved": "https://registry.npmjs.org/@noble/hashes/-/hashes-1.4.0.tgz",
      "integrity": "sha512-V1JJ1WTRUqHHrOSh597hURcMqVKVGL/ea3kv0gSnEdsEZ0/+VyPghM1lMNGc00z7CIQorSvbKpuJkxvuHbvdbg==",
      "license": "MIT",
      "engines": {
        "node": ">= 16"
      },
      "funding": {
        "url": "https://paulmillr.com/funding/"
      }
    }
  }
}

{
  "name": "sample-noble-hashes-hmac",
  "version": "1.0.0",
  "description": "Clean-room verification sample for hmac in @noble/hashes",
  "main": "index.js",
  "license": "MIT-0",
  "dependencies": {
    "@noble/hashes": "1.4.0"
  }
}

{
  "schemaVersion": 1,
  "goal": "verify hmac in pkg:npm/%40noble/hashes@1.4.0",
  "kind": "HOW",
  "packages": [
    "pkg:npm/%40noble/hashes@1.4.0"
  ],
  "symbols": [
    "hmac"
  ]
}

import assert from 'node:assert';
import {
  hmac,
  HMAC,
  sha256,
  sha512,
  sha3_256,
  computeHmac,
  createHmacStream,
  bytesToHex,
  hexToBytes,
  utf8ToBytes,
} from '../index.js';

// 1. RFC 4231 Test Case 1: HMAC-SHA256 with 20-byte key
const tc1Key = new Uint8Array(20).fill(0x0b);
const tc1Data = utf8ToBytes('Hi There');
const tc1Digest = computeHmac(sha256, tc1Key, tc1Data);
assert.strictEqual(
  tc1Digest,
  'b0344c61d8db38535ca8afceaf0bf12b881dc200c9833da726e9376c2e32cff7',
  'HMAC-SHA256 RFC 4231 TC1 produces expected digest'
);

// 2. RFC 4231 Test Case 2: HMAC-SHA256 with string key "Jefe"
const tc2Key = 'Jefe';
const tc2Data = 'what do ya want for nothing?';
const tc2Digest = computeHmac(sha256, tc2Key, tc2Data);
assert.strictEqual(
  tc2Digest,
  '5bdcc146bf60754e6a042426089575c75a003f089d2739839dec58b964ec3843',
  'HMAC-SHA256 RFC 4231 TC2 produces expected digest'
);

// 3. RFC 4231 Test Case 6: HMAC-SHA256 with large key (131 bytes > block size of 64 bytes)
const tc6Key = new Uint8Array(131).fill(0xaa);
const tc6Data = 'Test Using Larger Than Block-Size Key - Hash Key First';
const tc6Digest = computeHmac(sha256, tc6Key, tc6Data);
assert.strictEqual(
  tc6Digest,
  '60e431591ee0b67f0d8a26aacbf5b77f8e0bc6213728c5140546040f0ee37f54',
  'HMAC-SHA256 handles keys larger than block size'
);

// 4. HMAC-SHA512 with RFC 4231 Test Case 2
const tc2Digest512 = computeHmac(sha512, tc2Key, tc2Data);
assert.strictEqual(
  tc2Digest512,
  '164b7a7bfcf819e2e395fbe73b56e0a387bd64222e831fd610270cd7ea2505549758bf75c05a994a6d034f65f8f0e6fdcaeab1a34d4a6b4b636e070a38bce737',
  'HMAC-SHA512 produces expected 512-bit message authentication code'
);

// 5. Streaming HMAC with hmac.create and incremental .update()
const streamHmac = createHmacStream(sha256, tc2Key);
streamHmac.update('what do ');
streamHmac.update('ya want for nothing?');
assert.strictEqual(
  streamHmac.digest(),
  tc2Digest,
  'Streaming HMAC digest matches one-shot HMAC computation'
);

// 6. Direct hmac call returning Uint8Array
const rawHmacBytes = hmac(sha256, utf8ToBytes(tc2Key), utf8ToBytes(tc2Data));
assert(rawHmacBytes instanceof Uint8Array, 'hmac returns Uint8Array');
assert.strictEqual(rawHmacBytes.length, 32, 'HMAC-SHA256 returns 32 bytes');
assert.strictEqual(bytesToHex(rawHmacBytes), tc2Digest, 'Direct hmac output matches computed hex');

console.log('All HMAC contract assertions passed.');