judgevet._fingerprint
Status: draft.
judgevet._fingerprint
Compute the keyed state fingerprint outside the pure domain.
The fingerprint is HMAC-SHA-256 under a caller-held key over a fixed label, a
zero byte and the state as compact sorted-key JSON. The label and zero byte
follow the Label || 0x00 || Context input of NIST SP 800-108.
Source: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-108r1-upd1.pdf.
A keyed hash is only as irreversible as the key is secret, and equal inputs
still give equal outputs.
Source: https://arxiv.org/pdf/1802.07975.
Examples:
from judgevet._fingerprint import state_fingerprint
value = state_fingerprint(bytes(32), "synthetic")
assert value.startswith("ddc817f8d4f77bdd")
assert len(value) == 64
See Also
- judgevet.domain.audit.JudgmentRecord: Carries the fingerprint.
- judgevet.adapters.outbound.http: Computes it per logical call.
- judgevet.testing: The fakes compute it the same way.
state_fingerprint(key, state)
Return the lowercase hex HMAC-SHA-256 of the labelled state bytes.
Parameters:
| Name | Type | Description | Default |
|---|---|---|---|
key
|
bytes
|
Caller-held secret key. It is never stored or logged. |
required |
state
|
object
|
The caller's state, before any redaction. |
required |
Returns:
| Type | Description |
|---|---|
str
|
A 64-character lowercase hex digest. |
Raises:
| Type | Description |
|---|---|
TypeError
|
If the state is not JSON data. |
ValueError
|
If the state holds a non-finite number. |