The tests for HMAC are organized in such a way that makes the adoption of HACL* HMAC harder. More precisely, it'll be a bit harder to test the OpenSSL and the HACL* implementation of HMAC (for instance, some tests may or may not work with HACL* as they only support a subset of the hash functions supported by OpenSSL).

I am suggesting a way to make the test interface more generic using mixin classes. For instance, we have multiple ways of creating a HMAC object. It can be through hmac.HMAC or through hmac.new or through _hashlib.hmac_new. While hmac.new and hmac.HMAC are identical, _hashlib.hmac_new is different in the sense that the signature is different as well (and that the objects being returned are also different; they are not instances of hmac.HMAC but instances of _hashlib.HMAC, though they implement the same interface).

Now, once we add HACL* implementation, the interface will be similar to the Python implementation of HMAC and thus we need to test them both. Currently, it's hard to switch from the Python module implementation to the C implementation.

Linked PRs

• gh-130149: refactor tests for HMAC #130150
• gh-130149: fix HMAC tests for some FIPS-only build bots #130788
• gh-130149: cleanup refactorization of test_hmac.py #131318