nx_hmac_sha256_wasm.nx

nx_hmac_sha256_wasm.nx -- HMAC-SHA-256 (RFC 2104) for WAT target. HMAC(K, M) = H( (K' XOR opad) || H( (K' XOR ipad) || M ) ) K' = K when len(K) <= B (= 64 for SHA-256) H(K) padded with zeros to B otherwise ipad = 0x36 repeated B times opad = 0x5c repeated B times Built on top of nx_sha256_wasm.nx -- the SHA-256 helper functions are pasted in directly (NishiLang doesn't yet have multi-file imports for the WAT target, and the import would drag in the nx_syscalls atomics IR that the WAT backend doesn't lower). API for the embedder: nx_hmac_sha256_one_shot(key_ptr, key_len, msg_ptr, msg_len, scratch_ptr, out_ptr) -> i64 key_ptr -- HMAC key bytes key_len -- key byte count msg_ptr -- message bytes msg_len -- message byte count scratch_ptr -- 1024-byte scratch area (caller-allocated) out_ptr -- 32-byte HMAC output destination Memory layout of scratch_ptr (caller need not zero): bytes 0.. 63 : K' (block-sized key) buffer bytes 64.. 127 : K' XOR ipad buffer bytes 128.. 191 : K' XOR opad buffer bytes 192.. 223 : H(K' XOR ipad || M) inner hash output bytes 256.. 767 : SHA-256 ctx scratch (512 bytes, see nx_sha256_wasm) bytes 768.. 832 : 64-byte buffer used to concat K' XOR opad || inner_hash (64 + 32 = 96 bytes total, so reserve 96) Verified against RFC 4231 test vectors -- see bench/wasm_hmac_smoke.js. license_tier: INDEPENDENT_REDERIVE genealogy_id: international-research-sources/ietf/rfc_2104 + rfc_4231 lineage_id: nishi_hmac_sha256_wasm_q11