Add a routine for truncated HMAC verification

crypto/hmac.h

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Utility class for calculating the HMAC for a given message. We currently
 // only support SHA1 for the hash algorithm, but this can be extended easily.
 
 #ifndef CRYPTO_HMAC_H_
 #define CRYPTO_HMAC_H_
 #pragma once
@@ skipping 41 matching lines @@
   // returned in |digest|, which has |digest_length| bytes of storage available.
   // TODO(abarth): digest_length should be a size_t.
   bool Sign(const base::StringPiece& data, unsigned char* digest,
             int digest_length) const;
 
   // Verifies that the HMAC for the message in |data| equals the HMAC provided
   // in |digest|, using the algorithm supplied to the constructor and the key
   // supplied to the Init method. Use of this method is strongly recommended
   // over using Sign() with a manual comparison (such as memcmp), as such
   // comparisons may result in side-channel disclosures, such as timing, that
-  // undermine the cryptographic integrity. This method does not support
-  // comparing truncated HMACs.
+  // undermine the cryptographic integrity. |digest| must be exactly
+  // |DigestLength()| bytes long.
   bool Verify(const base::StringPiece& data,
               const base::StringPiece& digest) const;
 
+  // Verifies a truncated HMAC, behaving identical to Verify(), except
+  // that |digest| is allowed to be smaller than |DigestLength()|.
+  bool VerifyTruncated(const base::StringPiece& data,
+                       const base::StringPiece& digest) const;
+
  private:
   HashAlgorithm hash_alg_;
   scoped_ptr<HMACPlatformData> plat_;
 
   DISALLOW_COPY_AND_ASSIGN(HMAC);
 };
 
 }  // namespace crypto
 
 #endif  // CRYPTO_HMAC_H_