Private/Digest/New-SecretSharingDigestShare.ps1
|
function New-SecretSharingDigestShare { <# .SYNOPSIS Builds a SLIP-0039 digest share for a shared secret. .DESCRIPTION Generates a random "random part" the same length as the secret minus the digest length, computes the digest as the first 4 bytes of HMAC-SHA256(key = random part, message = secret), and returns digest + random part - a value the same total length as the secret, meant to be used as the FixedPoint anchor at the digest polynomial index (254) when splitting a secret whose threshold is 2 or more (see Split-SecretSharingShamirSecret). #> [CmdletBinding()] [OutputType([byte[]], [System.Object[]])] [Diagnostics.CodeAnalysis.SuppressMessageAttribute( 'PSUseShouldProcessForStateChangingFunctions', '', Justification = 'Pure in-memory computation (random bytes + HMAC); no external state is changed.')] param( [Parameter(Mandatory)] [byte[]]$Secret ) $constant = Get-SecretSharingDigestConstant if ($Secret.Length -le $constant.DigestLength) { throw "Secret must be longer than $($constant.DigestLength) bytes to build a digest share." } $randomPart = Get-SecretSharingRandomByte -Length ($Secret.Length - $constant.DigestLength) $fullHash = Invoke-SecretSharingHmacSha256 -Key $randomPart -Message $Secret $digest = [byte[]]$fullHash[0..($constant.DigestLength - 1)] return , ([byte[]]($digest + $randomPart)) } |