Module crypto::hkdf
HKDF (RFC 5869) over any hash.
Written once over hash.h's BlockHash through Hmac<H>, so HKDF-SHA256 and HKDF-SHA384 (TLS 1.3's key schedule, std/tls) are the same code:
unsigned char prk[SHA256_DIGEST_SIZE];
std::hkdf_extract(Sha256Ctx::new(), salt, saltLen, ikm, ikmLen, &prk[0]);
std::hkdf_expand(Sha256Ctx::new(), &prk[0], 32UL, info, infoLen, &okm[0], 42UL);
Freestanding-safe (no allocation).
Functions
| hkdf_extract | PRK = HMAC-Hash(salt, IKM), digest_size() bytes into 'prk'. An empty salt is the all-zero string of digest_size() bytes (RFC 5869 §2.2). |
| hkdf_expand | OKM = T(1) || T(2) || ... filling out (out.len bytes), T(i) = HMAC-Hash(PRK, T(i-1) || info || i); info may be empty. 0 (nothing written) if out.len > 255 * digest_size(), 1 otherwise. |