`std/digest`

Message digests: Sha256 and Sha512 (FIPS 180-4), Sha1 (FIPS 180-4 / RFC 3174) and Md5 (RFC 1321, legacy - see its own doc comment), and the Digest all four answer. SHA-256 is what the package manager pins a package by (docs/design/RELEASE.md section 7.2) and what a download is checked against; SHA-512 is what Ed25519 hashes with (std/signature).

Hmac (RFC 2104) is written once, over the Hasher trait every one of the four implements, and Hmac.pbkdf2 is PBKDF2 (RFC 8018) over it: SCRAM's password hash, and everything else that stretches a password or a key.

Ordinary TorbScript with no native. SHA-256, SHA-1 and MD5 work over Int, every word kept below 2^32 by a mask, so nothing overflows; SHA-512 over UInt64 and its wrapping sum. The same bytes give the same digest in both back ends.

Modules

std/digest/hmac[Hmac], HMAC (RFC 2104) over any [Hasher]: SCRAM (postgres, mongodb), S3's Signature Version 4, JWT's HS256, SMTP's CRAM-MD5.
std/digest/libMessage digests: [Sha256] and [Sha512] (FIPS 180-4), [Sha1] (FIPS 180-4 / RFC 3174) and [Md5] (RFC 1321, legacy - see its own doc comment), and the [Digest] all four answer.
std/digest/md5[Md5], the MD5 of RFC 1321.
std/digest/pbkdf2[Hmac.pbkdf2]: PBKDF2 (RFC 8018) over any [Hasher] through [Hmac] - the password hash SCRAM authenticates with, and NIST's key derivation function for a password or a passphrase.
std/digest/sha1[Sha1], the SHA-1 of FIPS 180-4 (RFC 3174): mysql_native_password, MongoDB's SCRAM-SHA-1 and the WebSocket handshake's accept key still ask for it, but nothing new should choose it over Sha256 - collisions are practical (SHAttered, 2017), which is why nothing here signs with it.
std/digest/sha512[Sha512], the SHA-512 of FIPS 180-4: the hash Ed25519 is defined over (RFC 8032 section 5.1, std/signature), and the same shape as Sha256 - fed at once or in pieces, answering a [Digest] of 64 bytes.

Everything

fn constantTimeEqual[Digest.equalsConstantTime] over two plain byte sequences: a thin wrapper for a caller that holds Bytes, not a [Digest].
type DigestWhat a hash function answers: its bytes, most significant first, shown as lowercase hexadecimal.
trait HasherA hash function fed in pieces, the shape [Sha256], [Sha512], [Sha1] and [Md5] share: a fresh value starts empty, [Hasher.add] feeds the next bytes, and [Hasher.finished] answers the [Digest] of everything fed so far without changing the hasher itself; [Hasher.of] is the one-call shortcut.
type HmacHMAC over H, keyed once and reused: the shape of [Sha256] and the rest, so it is fed the same way.
extend Hmac<H>The key derivation of PBKDF2 over any [Hmac], so over any [Hasher]: [Hmac.pbkdf2].
alias HmacMd5HMAC-MD5: SMTP's CRAM-MD5, the one place HMAC still meets [Md5].
alias HmacSha1HMAC-SHA-1: SCRAM-SHA-1 (mongodb), and the older signature schemes that have not moved to SHA-256.
alias HmacSha256HMAC-SHA-256: SCRAM-SHA-256, AWS Signature Version 4, JWT's HS256.
type Md5MD5, fed in pieces: [Md5.add] takes the next bytes and [Md5.finished] answers the digest of everything added so far without changing the hasher, so a hasher can be read, fed more, and read again.
type Sha1SHA-1, fed in pieces: [Sha1.add] takes the next bytes and [Sha1.finished] answers the digest of everything added so far without changing the hasher, so a hasher can be read, fed more, and read again.
type Sha256SHA-256, fed in pieces: [Sha256.add] takes the next bytes and [Sha256.finished] answers the digest of everything added so far without changing the hasher, so a hasher can be read, fed more, and read again.
type Sha512SHA-512, fed in pieces: [Sha512.add] takes the next bytes and [Sha512.finished] answers the digest of everything added so far without changing the hasher, so a hasher can be read, fed more, and read again.