it's nice, but I think you could upload crate.

I'm looking for SHA256 implementation for embedded and can't choose the proper one of several.

There are 4 no_std SHA256 implementations:

1. Yours.
2. DoumanAsh lhash - https://github.com/DoumanAsh/lhash/blob/master/src/sha256.rs
3. DaGenix rust-crypto - https://github.com/DaGenix/rust-crypto/blob/master/src/sha2.rs
4. RustCrypto hashes - https://github.com/RustCrypto/hashes/blob/master/sha2/src/sha256/soft.rs

Could you please tell what pros and cons does your implementation have compared to others?

Is HKDF::Extract mean to apply RFC 5869 with SHA-256 as the hash function? I am getting unexpected outputs using HKDF::extract.

From https://datatracker.ietf.org/doc/html/rfc5869 HKDF-Extract is defined as (with HASH=SHA-256)

HKDF-Extract(salt, IKM) -> PRK
where
PRK = HKDF-Extract(salt, IKM) = HMAC-Hash(salt, IKM) = HMAC-SHA-256(salt, IKM)

But this is not the result I get. Instead the code as defined does not even use it as a MAC, and instead:

pub fn extract(salt: impl AsRef<[u8]>, ikm: impl AsRef<[u8]>) -> [u8; 32] {
        let mut h = Hash::new();
        h.update(ikm);
        h.update(salt);
        h.finalize()
    }

I would expect it to be something like.

pub fn extract(salt: impl AsRef<[u8]>, ikm: impl AsRef<[u8]>) -> [u8; 32] {
       let mut hmac = HMAC::new(&salt);
       hmac .update(ikm);
       hmac.finalize()
    }

or even simpler:

pub fn extract(salt: impl AsRef<[u8]>, ikm: impl AsRef<[u8]>) -> [u8; 32] {
       HMAC::mac(ikm, salt)
    }