crypto.hpp File Reference

Cryptographic primitives needed by the venue connectors: HMAC-SHA256 (REST/WS signing), HMAC-SHA384 (Gemini), SHA-1 (WebSocket accept key), SHA-256, base64 and base64url (own implementation), CSPRNG bytes, Ed25519 (Binance session logon / Ed25519 API keys) and ECDSA P-256 (ES256 JWTs of Coinbase CDP keys). More...

#include <array>
#include <cstddef>
#include <cstdint>
#include <span>
#include <string>
#include <string_view>

Go to the source code of this file.

Classes
class	fastmm::net::FixedHexString< N >
	Fixed-capacity, NUL-terminated hex string (no heap). size() excludes the terminator. More...
class	fastmm::net::HmacSha256Key
	HMAC-SHA256 with the key schedule precomputed (see the header comment). More...
class	fastmm::net::Ed25519Key
	A parsed Ed25519 key (private, or public only for verification). Move-only. More...
class	fastmm::net::EcdsaP256Key

Namespaces
namespace	fastmm
namespace	fastmm::net

Typedefs
using	fastmm::net::Sha1Digest = std::array< std::uint8_t, kSha1Size >
using	fastmm::net::Sha256Digest = std::array< std::uint8_t, kSha256Size >
using	fastmm::net::HexSha256 = FixedHexString< kSha256Size >
using	fastmm::net::HexSha384 = FixedHexString< kSha384Size >
using	fastmm::net::HexSha512 = FixedHexString< kSha512Size >

Functions
bool	fastmm::net::hmac_sha256 (std::string_view key, std::string_view data, std::span< std::uint8_t, kSha256Size > out) noexcept
	HMAC-SHA256(key, data).
HexSha256	fastmm::net::hmac_sha256_hex (std::string_view key, std::string_view data) noexcept
HexSha384	fastmm::net::hmac_sha384_hex (std::string_view key, std::string_view data) noexcept
	HMAC-SHA384(key, data) as lowercase hex (Gemini signs its requests and the WebSocket upgrade with it).
HexSha512	fastmm::net::hmac_sha512_hex (std::string_view key, std::string_view data) noexcept
	HMAC-SHA512(key, data) as lowercase hex (Gate APIv4 signs REST requests and WebSocket logins with it) and SHA-512(data) as lowercase hex (the body digest inside a Gate signature string).
HexSha512	fastmm::net::sha512_hex (std::string_view data) noexcept
bool	fastmm::net::sha1 (std::string_view data, std::span< std::uint8_t, kSha1Size > out) noexcept
bool	fastmm::net::sha256 (std::string_view data, std::span< std::uint8_t, kSha256Size > out) noexcept
Sha1Digest	fastmm::net::sha1 (std::string_view data) noexcept
Sha256Digest	fastmm::net::sha256 (std::string_view data) noexcept
constexpr std::size_t	fastmm::net::base64_encoded_size (std::size_t n) noexcept
	RFC 4648 §4 base64 with '=' padding. base64_encoded_size(n) is the exact output size.
constexpr std::size_t	fastmm::net::base64_max_decoded_size (std::size_t n) noexcept
std::size_t	fastmm::net::base64_encode (std::span< const std::uint8_t > in, std::span< char > out) noexcept
	Writes into out (must be >= base64_encoded_size(in.size())); returns bytes written or 0 if the output is too small.
std::string	fastmm::net::base64_encode (std::span< const std::uint8_t > in)
std::string	fastmm::net::base64_encode (std::string_view in)
constexpr std::size_t	fastmm::net::base64url_encoded_size (std::size_t n) noexcept
	RFC 4648 §5 base64url without padding, the encoding of JWS/JWT segments.
std::size_t	fastmm::net::base64url_encode (std::span< const std::uint8_t > in, std::span< char > out) noexcept
std::string	fastmm::net::base64url_encode (std::string_view in)
std::size_t	fastmm::net::base64url_decode (std::string_view in, std::span< std::uint8_t > out) noexcept
	Unpadded base64url; SIZE_MAX on malformed input or insufficient output space.
std::size_t	fastmm::net::base64_decode (std::string_view in, std::span< std::uint8_t > out) noexcept
	Decodes standard base64 (padding required, no whitespace).
bool	fastmm::net::base64_decode (std::string_view in, std::string &out)
bool	fastmm::net::random_bytes (std::span< std::uint8_t > out) noexcept
	CSPRNG (RAND_bytes). Returns false if the RNG is unavailable.
std::string	fastmm::net::ed25519_sign_base64 (std::string_view private_key_pem, std::string_view data)
	Ed25519 signature (base64) of data using a PEM-encoded PKCS#8 private key.

Variables
constexpr std::size_t	fastmm::net::kSha1Size = 20
constexpr std::size_t	fastmm::net::kSha256Size = 32
constexpr std::size_t	fastmm::net::kSha384Size = 48
constexpr std::size_t	fastmm::net::kSha512Size = 64
constexpr std::size_t	fastmm::net::kEd25519SignatureSize = 64
constexpr std::size_t	fastmm::net::kEd25519Base64Size = 88
	base64_encoded_size(64)
constexpr std::size_t	fastmm::net::kEs256SignatureSize = 64
	ECDSA on P-256 with SHA-256 (JWS "ES256", RFC 7518 §3.4): the signature is r || s, 32 bytes each, big-endian.

Detailed Description

Cryptographic primitives needed by the venue connectors: HMAC-SHA256 (REST/WS signing), HMAC-SHA384 (Gemini), SHA-1 (WebSocket accept key), SHA-256, base64 and base64url (own implementation), CSPRNG bytes, Ed25519 (Binance session logon / Ed25519 API keys) and ECDSA P-256 (ES256 JWTs of Coinbase CDP keys).

OpenSSL 3 underneath; the header keeps OpenSSL out of the public interface.

HmacSha256Key hashes the key pads once and keeps the inner/outer SHA-256 midstates, so a signature costs the message blocks plus two compressions, with no allocation and no provider lookup (OpenSSL's SHA-256 block function uses SHA-NI / AVX2 when the CPU has them).