psa_mac_verify_finish() function

Active MAC operation.

Buffer containing the expected MAC value.

Size of the \p mac buffer in bytes.

Add a message fragment to a multipart MAC operation. The application must call psa_mac_sign_setup() or psa_mac_verify_setup() before calling this function. If this function returns an error status, the operation enters an error state and must be aborted by calling psa_mac_abort().

Abort a MAC operation. Aborting an operation frees all associated resources except for the \p operation structure itself. Once aborted, the operation object can be reused for another operation by calling psa_mac_sign_setup() or psa_mac_verify_setup() again. You may call this function any time after the operation object has been initialized by one of the methods described in #psa_mac_operation_t. In particular, calling psa_mac_abort() after the operation has been terminated by a call to psa_mac_abort(), psa_mac_sign_finish() or psa_mac_verify_finish() is safe and has no effect.

Finish the calculation of the MAC of a message. The application must call psa_mac_sign_setup() before calling this function. This function calculates the MAC of the message formed by concatenating the inputs passed to preceding calls to psa_mac_update(). When this function returns successfully, the operation becomes inactive. If this function returns an error status, the operation enters an error state and must be aborted by calling psa_mac_abort(). \warning Applications should not call this function if they expect a specific value for the MAC. Call psa_mac_verify_finish() instead. Beware that comparing integrity or authenticity data such as MAC values with a function such as \c memcmp is risky because the time taken by the comparison may leak information about the MAC value which could allow an attacker to guess a valid MAC and thereby bypass security controls.

Set up a multipart MAC calculation operation. This function sets up the calculation of the MAC (message authentication code) of a byte string. To verify the MAC of a message against an expected value, use psa_mac_verify_setup() instead. The sequence of operations to calculate a MAC is as follows: -# Allocate an operation object which will be passed to all the functions listed here. -# Initialize the operation object with one of the methods described in the documentation for #psa_mac_operation_t, e.g. #PSA_MAC_OPERATION_INIT. -# Call psa_mac_sign_setup() to specify the algorithm and key. -# Call psa_mac_update() zero, one or more times, passing a fragment of the message each time. The MAC that is calculated is the MAC of the concatenation of these messages in order. -# At the end of the message, call psa_mac_sign_finish() to finish calculating the MAC value and retrieve it. If an error occurs at any step after a call to psa_mac_sign_setup(), the operation will need to be reset by a call to psa_mac_abort(). The application may call psa_mac_abort() at any time after the operation has been initialized. After a successful call to psa_mac_sign_setup(), the application must eventually terminate the operation through one of the following methods: - A successful call to psa_mac_sign_finish(). - A call to psa_mac_abort().

Set up a multipart MAC verification operation. This function sets up the verification of the MAC (message authentication code) of a byte string against an expected value. The sequence of operations to verify a MAC is as follows: -# Allocate an operation object which will be passed to all the functions listed here. -# Initialize the operation object with one of the methods described in the documentation for #psa_mac_operation_t, e.g. #PSA_MAC_OPERATION_INIT. -# Call psa_mac_verify_setup() to specify the algorithm and key. -# Call psa_mac_update() zero, one or more times, passing a fragment of the message each time. The MAC that is calculated is the MAC of the concatenation of these messages in order. -# At the end of the message, call psa_mac_verify_finish() to finish calculating the actual MAC of the message and verify it against the expected value. If an error occurs at any step after a call to psa_mac_verify_setup(), the operation will need to be reset by a call to psa_mac_abort(). The application may call psa_mac_abort() at any time after the operation has been initialized. After a successful call to psa_mac_verify_setup(), the application must eventually terminate the operation through one of the following methods: - A successful call to psa_mac_verify_finish(). - A call to psa_mac_abort().