---
name: "libkeccak_hmac_digest"
section: "3"
platform: "linux"
package: "libkeccak"
version: "1.4.3-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libkeccak_hmac_digest"
---

# libkeccak\_hmac\_digest(3)

Complete the HMAC-hashing of a message with erasure

## NAME

libkeccak\_hmac\_digest - Complete the HMAC-hashing of a message with erasure

## SYNOPSIS

```
#include <libkeccak.h>
int libkeccak_hmac_digest(struct libkeccak_hmac_state *state, const void *msg, size_t msglen,
                          size_t bits, const char *suffix, void *hashsum);
```

Link with *-lkeccak*.

## DESCRIPTION

The **libkeccak\_hmac\_digest**() function absorbes the last part of (or all of) a message, and returns the HMAC hash of the entire message. The last part of the message is specified by the *msg* parameter, and its byte-size is specified by the *msglen* parameter. If all of the message has already be processed by calls to the [**libkeccak\_hmac\_update**(3)](/libkeccak_hmac_update/3.md) function or the [**libkeccak\_hmac\_fast\_update**(3)](/libkeccak_hmac_fast_update/3.md) function (with the same pointer on *state*,) *msg* and *msglen* should be set to *NULL* and 0, respectively.

If the message is not comprised a whole number of bytes, the number of bits, modulus 8, in the message should be specified in the *bits* parameter.  *msglen* must only count the number of whole bytes, that is, the floor of the number of bits in the message divided by 8.

*suffix* should be a NUL-terminated string of ASCII '1':s and '0':s, representing the bits that should be appended to the message. If this string is empty, *NULL* may be used instead. This is used to select hash algorithm. For pure Keccak, *NULL* or "" is used. For the other algorithms the constants **LIBKECCAK\_SHA3\_SUFFIX** (for SHA-3), **LIBKECCAK\_RAWSHAKE\_SUFFIX** (for RawSHAKE), and **LIBKECCAK\_SHAKE\_SUFFIX** (for SHAKE) are used.

The hash of the message will be stored to *hashsum*, unless *hashsum* is *NULL* (which increases the performance of the call.) A total of ((*state-\>n* + 7) / 8) bytes will be written to the beginning of *hashsum*. Therefore, *hashsum* needs at least an allocation size of that number of bytes.

The **libkeccak\_hmac\_digest**() function may reallocate the state's message chunk buffer. When doing so, it attempts to do so as securely as possible, rather than as fast as possible.

## RETURN VALUES

The **libkeccak\_hmac\_digest**() function returns 0 upon successful completion. On error, -1 is returned and *errno* is set to describe the error.

## ERRORS

The **libkeccak\_hmac\_digest**() function may fail for any reason specified by the function [**malloc**(3)](/malloc/3.md).

## SEE ALSO

[**libkeccak\_hmac\_create**(3)](/libkeccak_hmac_create/3.md), [**libkeccak\_hmac\_initialise**(3)](/libkeccak_hmac_initialise/3.md), [**libkeccak\_hmac\_update**(3)](/libkeccak_hmac_update/3.md), [**libkeccak\_hmac\_fast\_digest**(3)](/libkeccak_hmac_fast_digest/3.md)