HMAC: only 32 byte keys (#424)

* only support HMAC with 32 byte keys

* includes HMAC in the trait to be generic

* re-added HAMC test

src/ctap/client_pin.rs

@@ -44,7 +44,9 @@ pub const PIN_AUTH_LENGTH: usize = 16;
 /// The length of the pinUvAuthToken used throughout PIN protocols.
 ///
 /// The code assumes that this value is a multiple of the AES block length. It
-/// is fixed since CTAP2.1.
+/// is fixed since CTAP2.1, and the specification suggests that it coincides
+/// with the HMAC key length. Therefore a change would require a more general
+/// HMAC implementation.
 pub const PIN_TOKEN_LENGTH: usize = 32;
 
 /// The length of the encrypted PINs when received by SetPin or ChangePin.
@@ -486,9 +488,9 @@ impl ClientPin {
         if decrypted_salts.len() != 32 && decrypted_salts.len() != 64 {
             return Err(Ctap2StatusCode::CTAP1_ERR_INVALID_PARAMETER);
         }
-        let mut output = hmac_256::<Sha256>(&cred_random[..], &decrypted_salts[..32]).to_vec();
+        let mut output = hmac_256::<Sha256>(cred_random, &decrypted_salts[..32]).to_vec();
         if decrypted_salts.len() == 64 {
-            let mut output2 = hmac_256::<Sha256>(&cred_random[..], &decrypted_salts[32..]).to_vec();
+            let mut output2 = hmac_256::<Sha256>(cred_random, &decrypted_salts[32..]).to_vec();
             output.append(&mut output2);
         }
         shared_secret.encrypt(rng, &output)

src/ctap/pin_protocol.rs

@@ -134,7 +134,7 @@ pub trait SharedSecret {
     fn authenticate(&self, message: &[u8]) -> Vec<u8>;
 }
 
-fn verify_v1(key: &[u8], message: &[u8], signature: &[u8]) -> Result<(), Ctap2StatusCode> {
+fn verify_v1(key: &[u8; 32], message: &[u8], signature: &[u8]) -> Result<(), Ctap2StatusCode> {
     if signature.len() != 16 {
         return Err(Ctap2StatusCode::CTAP1_ERR_INVALID_PARAMETER);
     }
@@ -145,7 +145,7 @@ fn verify_v1(key: &[u8], message: &[u8], signature: &[u8]) -> Result<(), Ctap2St
     }
 }
 
-fn verify_v2(key: &[u8], message: &[u8], signature: &[u8]) -> Result<(), Ctap2StatusCode> {
+fn verify_v2(key: &[u8; 32], message: &[u8], signature: &[u8]) -> Result<(), Ctap2StatusCode> {
     if signature.len() != 32 {
         return Err(Ctap2StatusCode::CTAP1_ERR_INVALID_PARAMETER);
     }