1 files changed, 15 insertions, 9 deletions
diff --git a/source/storage/KeyManager.mc b/source/storage/KeyManager.mc
index 2dd3712..ae2c5e8 100644
--- a/source/storage/KeyManager.mc
+++ b/source/storage/KeyManager.mc
@@ -81,17 +81,23 @@ class KeyManager {
     // entries while the watch is locked (docs/SECURITY.md).
     function fingerprint(entry as Entry) as ByteArray {
         deviceKeys();
-        var input = Bytes.fromUtf8("OTPW-FP-1");
-        input.add(entry.kind);
-        input.add(entry.type);
+        // The secret or contents go to the native HMAC as they are: a copy
+        // would need a byte-loop wipe (4 KB of contents, the watchdog).
+        var mac = new Cryptography.HashBasedMessageAuthenticationCode({
+            :algorithm => Cryptography.HASH_SHA256,
+            :key => _fingerprintKey as ByteArray
+        });
+        var prefix = Bytes.fromUtf8("OTPW-FP-1");
+        prefix.add(entry.kind);
+        prefix.add(entry.type);
+        mac.update(prefix);
         var material = entry.kind == Entry.KIND_OTP ? entry.secret : entry.payload;
-        if (material != null) {
-            input.addAll(material);
+        if (material != null && material.size() > 0) {
+            mac.update(material);
         }
-        var mac = Hmac.nativeSha256(_fingerprintKey as ByteArray, input);
-        Bytes.wipe(input);
-        var out = mac.slice(0, FINGERPRINT_BYTES);
-        Bytes.wipe(mac);
+        var digest = mac.digest();
+        var out = digest.slice(0, FINGERPRINT_BYTES);
+        Bytes.wipe(digest);
         return out;
     }