///|
/// HMAC-SHA256 (RFC 2104), built on this package's SHA-256 primitive.
///
/// Needed by AWS SigV4 request signing, which derives its signing key through
/// a chain of four HMACs.
const HMAC_SHA256_BLOCK : Int = 64

///|
/// Normalize a key to exactly one SHA-256 block: hash it when it is longer
/// than the block, then zero-pad to the block size.
fn hmac_sha256_block_key(key : Bytes) -> FixedArray[Byte] {
  let block : FixedArray[Byte] = FixedArray::make(HMAC_SHA256_BLOCK, b'\x00')
  let normalized = if key.length() > HMAC_SHA256_BLOCK {
    let digest = sha256_raw(key)
    Bytes::makei(digest.length(), i => digest[i])
  } else {
    key
  }
  for i in 0.. FixedArray[Byte] {
  let block = hmac_sha256_block_key(key)
  let inner = Sha256State::new()
  for i in 0.. Bytes {
  let digest = hmac_sha256_raw(key, msg)
  Bytes::makei(digest.length(), i => digest[i])
}