发布 0.2.1 并完善工具边界与安全性

tests/cmac.test.ts

@@ -1,6 +1,6 @@
 import { describe, expect, it } from 'vitest'
 import { bytesToHex, parseHex } from '../src/lib/bytes'
-import { aes128Cmac } from '../src/lib/cmac'
+import { aes128Cmac, aesCmac } from '../src/lib/cmac'
 
 describe('AES-128-CMAC RFC 4493 vectors', () => {
   const key = parseHex('2B7E151628AED2A6ABF7158809CF4F3C')
@@ -15,3 +15,42 @@ describe('AES-128-CMAC RFC 4493 vectors', () => {
     expect(bytesToHex(aes128Cmac(key, parseHex(message)), '')).toBe(expected)
   })
 })
+
+describe('AES-CMAC NIST SP 800-38B vectors', () => {
+  it.each([
+    {
+      name: 'AES-192 empty message',
+      key: '8E73B0F7DA0E6452C810F32B809079E562F8EAD2522C6B7B',
+      message: '',
+      expected: 'D17DDF46ADAACDE531CAC483DE7A9367',
+    },
+    {
+      name: 'AES-192 one block',
+      key: '8E73B0F7DA0E6452C810F32B809079E562F8EAD2522C6B7B',
+      message: '6BC1BEE22E409F96E93D7E117393172A',
+      expected: '9E99A7BF31E710900662F65E617C5184',
+    },
+    {
+      name: 'AES-256 empty message',
+      key: '603DEB1015CA71BE2B73AEF0857D77811F352C073B6108D72D9810A30914DFF4',
+      message: '',
+      expected: '028962F61B7BF89EFC6B551F4667D983',
+    },
+    {
+      name: 'AES-256 one block',
+      key: '603DEB1015CA71BE2B73AEF0857D77811F352C073B6108D72D9810A30914DFF4',
+      message: '6BC1BEE22E409F96E93D7E117393172A',
+      expected: '28A7023F452E8F82BD4BF28D8C37C35C',
+    },
+  ])('matches $name', ({ key, message, expected }) => {
+    expect(bytesToHex(aesCmac(parseHex(key), parseHex(message)), '')).toBe(expected)
+  })
+
+  it.each([0, 15, 17, 23, 25, 31, 33])('rejects a %s-byte key', (length) => {
+    expect(() => aesCmac(new Uint8Array(length), new Uint8Array())).toThrow('16、24 或 32 字节')
+  })
+
+  it('keeps the AES-128 compatibility wrapper strict', () => {
+    expect(() => aes128Cmac(new Uint8Array(24), new Uint8Array())).toThrow('AES-128 密钥必须是 16 字节')
+  })
+})