SequenceFunction: the construction both SequenceHash and SequenceMAC are built on (spec section "SequenceFunction").

Given a hash function H with block size b and output length L, a key K (empty for SequenceHash), a customization string S, a function indicator F and inputs M_1 .. M_n:

SequenceFunction(H, K, S, F; M_1, ..., M_n) =
    H( K_O || HeaderO(b, F, S, K) || S' || EncodeMSBF(n) || EncodeMSBF(L) ||
       H( K_I || HeaderI(b, F, K) || Encode(M_1) || ... || Encode(M_n) ) )

where K_I = Derive(K, H, 0x55), K_O = Derive(K, H, 0xaa) and S' = Derive(S, H, 0x00).

How this module maps to the formula

• new/3 absorbs K_I || HeaderI into the inner hash state and K_O into the outer hash state. The key itself is not kept, only its length.
• add/2 absorbs Encode(M_i) into the inner state and counts n.
• result/2 finishes the inner hash and feeds the outer hash. It works on copies, so the state can keep growing or be finished again with a different customization string.

:crypto hash states are persistent: :crypto.hash_update/2 returns a new state and leaves the old one valid. That is what makes this struct an ordinary immutable value.

Keys

new/3 enforces the key rules for each function indicator, so this module cannot build a SequenceMAC with a key the specification forbids: SequenceMAC (F = 1) keys must be at least 32 bytes, and SequenceHash (F = 2) has no key, so its key must be empty.

Secret material

For SequenceMAC, inner and outer have absorbed the derived key blocks, so the struct is as sensitive as the key. Its Inspect output omits them. Functions that receive a key check their arguments in the function body and raise errors that do not include them, so a bad call cannot copy the key into a crash report. The BEAM cannot reliably zeroize memory, so derived key blocks are not wiped (the specification says SHOULD); they are short-lived binaries that are reclaimed by garbage collection.

Most callers should use SequenceHash or SequenceHash.MAC instead of this module. It is public so that auditors can check each step against the specification and so the test suite can check the intermediate values in the C2SP/CCTV vectors.