How to sign and verify a message with HMAC-SHA256 in Rust

1[dependencies]
2hmac = "=0.13.0"
3sha2 = "=0.11.1"
4hex = "=0.4.3"
5 

1use hmac::{Hmac, KeyInit, Mac};
2use sha2::Sha256;
3 
4type HmacSha256 = Hmac<Sha256>;
5 
6/// Sender: HMAC-SHA256 over the exact body bytes, sent as "sha256=<hex>".
7pub fn sign(secret: &[u8], raw_body: &[u8]) -> String {
8    let mut mac = HmacSha256::new_from_slice(secret).expect("HMAC takes keys of any length");
9    mac.update(raw_body);
10    format!("sha256={}", hex::encode(mac.finalize().into_bytes()))
11}
12 
13/// Receiver: recompute over the raw body; verify_slice compares in constant time.
14pub fn verify(secret: &[u8], raw_body: &[u8], header: Option<&str>) -> bool {
15    let Some(received) = header
16        .and_then(|value| value.strip_prefix("sha256="))
17        .and_then(|hex_mac| hex::decode(hex_mac).ok())
18    else {
19        return false; // a missing or malformed header fails, it never skips the check
20    };
21    let mut mac = HmacSha256::new_from_slice(secret).expect("HMAC takes keys of any length");
22    mac.update(raw_body);
23    mac.verify_slice(&received).is_ok() // Err for a wrong MAC and for a wrong length
24}
25 

How it works

1. HmacSha256::new_from_slice(secret) creates the MAC state (HMAC accepts keys of any length, hence the expect); update feeds the body and finalize().into_bytes() returns the 32 bytes.
2. verify_slice(&received) finalizes the MAC and compares it with the received bytes in constant time, returning Err for a mismatch and for a slice of the wrong length. Comparing into_bytes() with == would compare plain arrays with an early exit; verify_slice (like the CtOutput that finalize() returns) does not.
3. verify turns every malformed input — no header, no sha256= prefix, invalid hex — into false with one let … else, so no branch can accidentally accept an unsigned request.
4. The run checks GitHub's example: Hello, World! with the secret It's a Secret to Everybody gives sha256=757107ea…3e17, while a tampered body, a wrong secret and a truncated header are rejected.

Gotchas

• hex::decode refuses an odd number of digits (Err(OddLength)) and any non-hex character; treat every decoding error as an invalid signature.
• hex::decode accepts upper-case digits — the run verifies sha256=757107EA… — so normalising the header's case is unnecessary when you compare bytes, not strings.
• A truncated header decodes to fewer than 32 bytes, and verify_slice rejects it (truncated header: false) instead of comparing a prefix; do not slice the computed MAC to the received length to make them "match".

Related recipes

• How to sign and verify a message with HMAC-SHA256 in Go
• How to sign and verify a message with HMAC-SHA256 in Swift
• How to sign and verify a message with HMAC-SHA256 in Python
• How to sign and verify a message with HMAC-SHA256 in Node.js
• How to verify an ES256 JWT in Rust