derive static method

Uint8List derive({ required Uint8List macKey, required int window, required Uint8List nonce, required Uint8List ciphertext, })

Computes: tag = HMAC_SHA256(macKey, "tag" || u64be(window) || nonce || ciphertext)

RETURNS: 32-byte HMAC-SHA256 tag.

Throws ArgumentError if inputs are malformed.

Implementation

static Uint8List derive({
  required Uint8List macKey,
  required int window,
  required Uint8List nonce,
  required Uint8List ciphertext,
}) {
  if (macKey.isEmpty) {
    throw ArgumentError('macKey must not be empty.');
  }
  NonceGenerator.validate(nonce);

  // Prepare input = "tag" || u64be(window) || nonce || ciphertext
  final wBytes = Bytes.u64beInt(window);
  final parts = <Uint8List>[
    Bytes.tagLabel,
    wBytes,
    nonce,
    ciphertext,
  ];

  // Compute HMAC over the concatenated parts.
  return HmacSha256.computeParts(macKey, parts);
}