{
 "cells": [
  {
   "cell_type": "markdown",
   "id": "advised-checkout",
   "metadata": {},
   "source": [
    "## Hash-based Message Authentication Codes\n",
    "\n",
    "[https://en.wikipedia.org/wiki/HMAC]\n",
    "\n",
    "In cryptography, an HMAC (sometimes expanded as either keyed-hash\n",
    "message authentication code or hash-based message authentication code)\n",
    "is a specific type of message authentication code (MAC) involving a\n",
    "cryptographic hash function and a secret cryptographic key. As with\n",
    "any MAC, it may be used to simultaneously verify both the data\n",
    "integrity and authenticity of a message.\n",
    "\n",
    "[C API Documentation](https://doc.libsodium.org/advanced/hmac-sha2)\n",
    "\n",
    "pgsodium provides hmacsha512 and hmacsha256, only 512-bit examples are provided below, the 256-bit API is identical but using names like `crypto_auth_hmacsha256_*`.\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "id": "5bb63793-9b18-434c-a198-edb4959fca2f",
   "metadata": {
    "tags": []
   },
   "outputs": [],
   "source": [
    "%load_ext sql"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "id": "ed24261d-6f7e-4128-ac5e-1fac54d5cd46",
   "metadata": {
    "tags": []
   },
   "outputs": [],
   "source": [
    "%config SqlMagic.feedback=False\n",
    "%config SqlMagic.displaycon=False\n",
    "%sql postgresql://postgres@/"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "id": "9418043b-b04d-41bb-857a-169d69be6c54",
   "metadata": {
    "tags": []
   },
   "outputs": [
    {
     "data": {
      "text/plain": [
       "[]"
      ]
     },
     "execution_count": 3,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "%%sql \n",
    "CREATE EXTENSION IF NOT EXISTS pgsodium;"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "d24f2168-7c64-42e9-b9f6-f6fa4cffe787",
   "metadata": {},
   "source": [
    "### `crypto_auth_hmacsha512_keygen()`"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "id": "dc7110c4-f30b-4c04-a999-1c8f724cab21",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "b'|\\'\\x88\\xf1\\x88\\x82\\x8b\\xcb\"O\\x1a\\'\\xb8#c\\xa6f\\x1ag\\x05nx5\\xc2\\xe5u8</\\xa0\\xbd\\x18'\n"
     ]
    }
   ],
   "source": [
    "key = %sql select pgsodium.crypto_auth_hmacsha512_keygen()\n",
    "key = key[0][0].tobytes()\n",
    "print(key)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "101da183-2791-4436-b3e5-ae5335533dc4",
   "metadata": {},
   "source": [
    "### `crypto_auth_hmacsha512(message bytea, key bytea)`"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "id": "1a638b75-2c72-43d9-8ff7-c6934f59c7e9",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "b'2\\xae\\x9d_\\xb2\\xaf\\xf1\\x08tq2\\x97V*\\xb1\\x10\\xb6b\\xb1s\\xcc\\x06\\x95\\x12\\x9f\\xfb\\xbc\\x07-L]m\\x88\\\\\\x80\\x98\\x8cHc\\xbd\\x96\\xe5\\xb1\\xd9{\\x17\\x1eP\\x11^\\xc3\\x1f\\x89\\xb7\\xacL&\\x12\\xd7\\xefr\\xe7j8'\n"
     ]
    }
   ],
   "source": [
    "signature = %sql select pgsodium.crypto_auth_hmacsha512('this is authentic', :key)\n",
    "signature = signature[0][0].tobytes()\n",
    "print(signature)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "7313cbca-0e41-43e3-9816-94d7279bec0b",
   "metadata": {},
   "source": [
    "### `crypto_auth_hmacsha512_verify(signature bytea, message bytea, key bytea)`"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 6,
   "id": "e580dc4f-bfe3-4f92-98e9-b7f745825193",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "+-------------------------------+\n",
      "| crypto_auth_hmacsha512_verify |\n",
      "+-------------------------------+\n",
      "|              True             |\n",
      "+-------------------------------+\n"
     ]
    }
   ],
   "source": [
    "verify = %sql select pgsodium.crypto_auth_hmacsha512_verify(:signature, 'this is authentic', :key)\n",
    "print(verify)"
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3 (ipykernel)",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.9.2"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 5
}