{
  "context": "This criteria evaluates how well the engineer uses crypto-browserify's HMAC functionality to implement message authentication. The focus is on proper usage of createHmac, the Hmac class methods (update and digest), and understanding of HMAC patterns for authentication and verification.",
  "type": "weighted_checklist",
  "checklist": [
    {
      "name": "Uses createHmac",
      "description": "Implementation uses crypto.createHmac() to create HMAC instances with the specified algorithm and key",
      "max_score": 25
    },
    {
      "name": "Calls update method",
      "description": "Uses the update() method on HMAC objects to add message data for authentication",
      "max_score": 20
    },
    {
      "name": "Calls digest method",
      "description": "Uses the digest() method with 'hex' encoding to generate the final authentication tag",
      "max_score": 20
    },
    {
      "name": "Incremental processing",
      "description": "Implements incremental message authentication by calling update() multiple times before calling digest() for chunk-based processing",
      "max_score": 20
    },
    {
      "name": "Algorithm support",
      "description": "Correctly passes algorithm parameter to createHmac to support different hash algorithms (e.g., 'sha256', 'sha512')",
      "max_score": 10
    },
    {
      "name": "Tag verification",
      "description": "Implements proper tag verification by generating a new HMAC with the same parameters and comparing the result with the expected tag",
      "max_score": 5
    }
  ]
}