From c352d376ed4de2958c55dae960c6efd40b263c6d Mon Sep 17 00:00:00 2001
From: "Tobin C. Harding" <me@tobin.cc>
Date: Thu, 30 Jan 2025 10:47:18 +1100
Subject: [PATCH] Do not implement Default for HmacEngine

The `HmacEngine` should be created using a key. Currently we are
providing a `Default` impl that uses `&[]` as the key. This is, I
believe, a hangover from when we had a `Default` trait bound somewhere
else. It is incorrect and an API footgun - remove it.
---
 hashes/src/hmac.rs         | 13 +++----------
 hashes/tests/regression.rs | 16 ----------------
 2 files changed, 3 insertions(+), 26 deletions(-)

diff --git a/hashes/src/hmac.rs b/hashes/src/hmac.rs
index 283bdc7d0..c3dca2d85 100644
--- a/hashes/src/hmac.rs
+++ b/hashes/src/hmac.rs
@@ -31,13 +31,6 @@ pub struct HmacEngine<T: GeneralHash> {
     oengine: T::Engine,
 }
 
-impl<T: GeneralHash> Default for HmacEngine<T>
-where
-    <T as GeneralHash>::Engine: Default,
-{
-    fn default() -> Self { HmacEngine::new(&[]) }
-}
-
 impl<T: GeneralHash> HmacEngine<T> {
     /// Constructs a new keyed HMAC from `key`.
     ///
@@ -328,7 +321,7 @@ mod benches {
 
     #[bench]
     pub fn hmac_sha256_10(bh: &mut Bencher) {
-        let mut engine = Hmac::<sha256::Hash>::engine();
+        let mut engine = HmacEngine::<sha256::Hashe>::new(&[]);
         let bytes = [1u8; 10];
         bh.iter(|| {
             engine.input(&bytes);
@@ -338,7 +331,7 @@ mod benches {
 
     #[bench]
     pub fn hmac_sha256_1k(bh: &mut Bencher) {
-        let mut engine = Hmac::<sha256::Hash>::engine();
+        let mut engine = HmacEngine::<sha256::Hashe>::new(&[]);
         let bytes = [1u8; 1024];
         bh.iter(|| {
             engine.input(&bytes);
@@ -348,7 +341,7 @@ mod benches {
 
     #[bench]
     pub fn hmac_sha256_64k(bh: &mut Bencher) {
-        let mut engine = Hmac::<sha256::Hash>::engine();
+        let mut engine = HmacEngine::<sha256::Hashe>::new(&[]);
         let bytes = [1u8; 65536];
         bh.iter(|| {
             engine.input(&bytes);
diff --git a/hashes/tests/regression.rs b/hashes/tests/regression.rs
index d40998e36..0b6856794 100644
--- a/hashes/tests/regression.rs
+++ b/hashes/tests/regression.rs
@@ -56,22 +56,6 @@ fn regression_sha256t() {
     assert_eq!(got, want);
 }
 
-#[test]
-fn regression_hmac_sha256_with_default_key() {
-    let hash = Hmac::<sha256::Hash>::hash(DATA.as_bytes());
-    let got = format!("{}", hash);
-    let want = "58cc7ed8567bd86eba61f7ed2d5a4edab1774dc10488e57de2eb007a2d9ae82d";
-    assert_eq!(got, want);
-}
-
-#[test]
-fn regression_hmac_sha512_with_default_key() {
-    let hash = Hmac::<sha512::Hash>::hash(DATA.as_bytes());
-    let got = format!("{}", hash);
-    let want = "5f5db2f3e1178bf19af5db38a0ed04dc5bc52d641648542886eea9b6bbec0db658ed7a5799ca18f5bc1949f39d24151a32990ee85974e40bb8a35e2288f494ce";
-    assert_eq!(got, want);
-}
-
 #[test]
 fn regression_hmac_sha256_with_key() {
     let mut engine = HmacEngine::<sha256::Hash>::new(HMAC_KEY);