providers/implementations/kdfs/hkdf.c

   1 /*
   2  * Copyright 2016-2024 The OpenSSL Project Authors. All Rights Reserved.
   3  *
   4  * Licensed under the Apache License 2.0 (the "License").  You may not use
   5  * this file except in compliance with the License.  You can obtain a copy
   6  * in the file LICENSE in the source distribution or at
   7  * https://www.openssl.org/source/license.html
   8  */
   9
  10 /*
  11  * HMAC low level APIs are deprecated for public use, but still ok for internal
  12  * use.
  13  */
  14 #include "internal/deprecated.h"
  15
  16 #include <stdlib.h>
  17 #include <stdarg.h>
  18 #include <string.h>
  19 #include <openssl/hmac.h>
  20 #include <openssl/evp.h>
  21 #include <openssl/kdf.h>
  22 #include <openssl/core_names.h>
  23 #include <openssl/proverr.h>
  24 #include "internal/cryptlib.h"
  25 #include "internal/numbers.h"
  26 #include "internal/packet.h"
  27 #include "crypto/evp.h"
  28 #include "prov/provider_ctx.h"
  29 #include "prov/providercommon.h"
  30 #include "prov/implementations.h"
  31 #include "prov/provider_util.h"
  32 #include "prov/securitycheck.h"
  33 #include "internal/e_os.h"
  34 #include "internal/params.h"
  35 #include "internal/sizes.h"
  36
  37 #define HKDF_MAXBUF 2048
  38 #define HKDF_MAXINFO (32*1024)
  39
  40 static OSSL_FUNC_kdf_newctx_fn kdf_hkdf_new;
  41 static OSSL_FUNC_kdf_dupctx_fn kdf_hkdf_dup;
  42 static OSSL_FUNC_kdf_freectx_fn kdf_hkdf_free;
  43 static OSSL_FUNC_kdf_reset_fn kdf_hkdf_reset;
  44 static OSSL_FUNC_kdf_derive_fn kdf_hkdf_derive;
  45 static OSSL_FUNC_kdf_settable_ctx_params_fn kdf_hkdf_settable_ctx_params;
  46 static OSSL_FUNC_kdf_set_ctx_params_fn kdf_hkdf_set_ctx_params;
  47 static OSSL_FUNC_kdf_gettable_ctx_params_fn kdf_hkdf_gettable_ctx_params;
  48 static OSSL_FUNC_kdf_get_ctx_params_fn kdf_hkdf_get_ctx_params;
  49 static OSSL_FUNC_kdf_derive_fn kdf_tls1_3_derive;
  50 static OSSL_FUNC_kdf_settable_ctx_params_fn kdf_tls1_3_settable_ctx_params;
  51 static OSSL_FUNC_kdf_set_ctx_params_fn kdf_tls1_3_set_ctx_params;
  52 static OSSL_FUNC_kdf_gettable_ctx_params_fn kdf_tls1_3_gettable_ctx_params;
  53 static OSSL_FUNC_kdf_get_ctx_params_fn kdf_tls1_3_get_ctx_params;
  54 static OSSL_FUNC_kdf_newctx_fn kdf_hkdf_sha256_new;
  55 static OSSL_FUNC_kdf_newctx_fn kdf_hkdf_sha384_new;
  56 static OSSL_FUNC_kdf_newctx_fn kdf_hkdf_sha512_new;
  57
  58 static void *kdf_hkdf_fixed_digest_new(void *provctx, const char *digest);
  59 static void kdf_hkdf_reset_ex(void *vctx, int on_free);
  60
  61 static int HKDF(OSSL_LIB_CTX *libctx, const EVP_MD *evp_md,
  62                 const unsigned char *salt, size_t salt_len,
  63                 const unsigned char *key, size_t key_len,
  64                 const unsigned char *info, size_t info_len,
  65                 unsigned char *okm, size_t okm_len);
  66 static int HKDF_Extract(OSSL_LIB_CTX *libctx, const EVP_MD *evp_md,
  67                         const unsigned char *salt, size_t salt_len,
  68                         const unsigned char *ikm, size_t ikm_len,
  69                         unsigned char *prk, size_t prk_len);
  70 static int HKDF_Expand(const EVP_MD *evp_md,
  71                        const unsigned char *prk, size_t prk_len,
  72                        const unsigned char *info, size_t info_len,
  73                        unsigned char *okm, size_t okm_len);
  74
  75 /* Settable context parameters that are common across HKDF and the TLS KDF */
  76 #define HKDF_COMMON_SETTABLES                                       \
  77     OSSL_PARAM_utf8_string(OSSL_KDF_PARAM_MODE, NULL, 0),           \
  78     OSSL_PARAM_int(OSSL_KDF_PARAM_MODE, NULL),                      \
  79     OSSL_PARAM_utf8_string(OSSL_KDF_PARAM_PROPERTIES, NULL, 0),     \
  80     OSSL_PARAM_utf8_string(OSSL_KDF_PARAM_DIGEST, NULL, 0),         \
  81     OSSL_PARAM_octet_string(OSSL_KDF_PARAM_KEY, NULL, 0),           \
  82     OSSL_PARAM_octet_string(OSSL_KDF_PARAM_SALT, NULL, 0)
  83
  84 /*
  85  * Gettable context parameters that are common across HKDF and the TLS KDF.
  86  *   OSSL_KDF_PARAM_KEY is not gettable because it is a secret value.
  87  */
  88 #define HKDF_COMMON_GETTABLES                                       \
  89     OSSL_PARAM_size_t(OSSL_KDF_PARAM_SIZE, NULL),                   \
  90     OSSL_PARAM_utf8_string(OSSL_KDF_PARAM_MODE, NULL, 0),           \
  91     OSSL_PARAM_int(OSSL_KDF_PARAM_MODE, NULL),                      \
  92     OSSL_PARAM_utf8_string(OSSL_KDF_PARAM_DIGEST, NULL, 0),         \
  93     OSSL_PARAM_octet_string(OSSL_KDF_PARAM_SALT, NULL, 0),          \
  94     OSSL_PARAM_octet_string(OSSL_KDF_PARAM_INFO, NULL, 0)
  95
  96 typedef struct {
  97     void *provctx;
  98     int mode;
  99     PROV_DIGEST digest;
 100     unsigned char *salt;
 101     size_t salt_len;
 102     unsigned char *key;
 103     size_t key_len;
 104     unsigned char *prefix;
 105     size_t prefix_len;
 106     unsigned char *label;
 107     size_t label_len;
 108     unsigned char *data;
 109     size_t data_len;
 110     unsigned char *info;
 111     size_t info_len;
 112     int fixed_digest;
 113     OSSL_FIPS_IND_DECLARE
 114 } KDF_HKDF;
 115
 116 static void *kdf_hkdf_new(void *provctx)
 117 {
 118     KDF_HKDF *ctx;
 119
 120     if (!ossl_prov_is_running())
 121         return NULL;
 122
 123     if ((ctx = OPENSSL_zalloc(sizeof(*ctx))) != NULL) {
 124         ctx->provctx = provctx;
 125         OSSL_FIPS_IND_INIT(ctx)
 126     }
 127     return ctx;
 128 }
 129
 130 static void kdf_hkdf_free(void *vctx)
 131 {
 132     KDF_HKDF *ctx = (KDF_HKDF *)vctx;
 133
 134     if (ctx != NULL) {
 135         kdf_hkdf_reset_ex(vctx, 1);
 136         OPENSSL_free(ctx);
 137     }
 138 }
 139
 140 static void kdf_hkdf_reset(void *vctx)
 141 {
 142     kdf_hkdf_reset_ex(vctx, 0);
 143 }
 144
 145 static void kdf_hkdf_reset_ex(void *vctx, int on_free)
 146 {
 147     KDF_HKDF *ctx = (KDF_HKDF *)vctx;
 148     void *provctx = ctx->provctx;
 149     int preserve_digest = on_free ? 0 : ctx->fixed_digest;
 150     PROV_DIGEST save_prov_digest = { 0 };
 151
 152     /* For fixed digests just save and restore the PROV_DIGEST object */
 153     if (preserve_digest)
 154         save_prov_digest = ctx->digest;
 155     else
 156         ossl_prov_digest_reset(&ctx->digest);
 157 #ifdef OPENSSL_PEDANTIC_ZEROIZATION
 158     OPENSSL_clear_free(ctx->salt, ctx->salt_len);
 159 #else
 160     OPENSSL_free(ctx->salt);
 161 #endif
 162     OPENSSL_free(ctx->prefix);
 163     OPENSSL_free(ctx->label);
 164     OPENSSL_clear_free(ctx->data, ctx->data_len);
 165     OPENSSL_clear_free(ctx->key, ctx->key_len);
 166     OPENSSL_clear_free(ctx->info, ctx->info_len);
 167     memset(ctx, 0, sizeof(*ctx));
 168     ctx->provctx = provctx;
 169     if (preserve_digest) {
 170         ctx->fixed_digest = preserve_digest;
 171         ctx->digest = save_prov_digest;
 172     }
 173 }
 174
 175 static void *kdf_hkdf_dup(void *vctx)
 176 {
 177     const KDF_HKDF *src = (const KDF_HKDF *)vctx;
 178     KDF_HKDF *dest;
 179
 180     dest = kdf_hkdf_new(src->provctx);
 181     if (dest != NULL) {
 182         if (!ossl_prov_memdup(src->salt, src->salt_len, &dest->salt,
 183                               &dest->salt_len)
 184                 || !ossl_prov_memdup(src->key, src->key_len,
 185                                      &dest->key , &dest->key_len)
 186                 || !ossl_prov_memdup(src->prefix, src->prefix_len,
 187                                      &dest->prefix, &dest->prefix_len)
 188                 || !ossl_prov_memdup(src->label, src->label_len,
 189                                      &dest->label, &dest->label_len)
 190                 || !ossl_prov_memdup(src->data, src->data_len,
 191                                      &dest->data, &dest->data_len)
 192                 || !ossl_prov_memdup(src->info, src->info_len,
 193                                      &dest->info, &dest->info_len)
 194                 || !ossl_prov_digest_copy(&dest->digest, &src->digest))
 195             goto err;
 196         dest->mode = src->mode;
 197         dest->fixed_digest = src->fixed_digest;
 198         OSSL_FIPS_IND_COPY(dest, src)
 199     }
 200     return dest;
 201
 202  err:
 203     kdf_hkdf_free(dest);
 204     return NULL;
 205 }
 206
 207 static size_t kdf_hkdf_size(KDF_HKDF *ctx)
 208 {
 209     int sz;
 210     const EVP_MD *md = ossl_prov_digest_md(&ctx->digest);
 211
 212     if (ctx->mode != EVP_KDF_HKDF_MODE_EXTRACT_ONLY)
 213         return SIZE_MAX;
 214
 215     if (md == NULL) {
 216         ERR_raise(ERR_LIB_PROV, PROV_R_MISSING_MESSAGE_DIGEST);
 217         return 0;
 218     }
 219     sz = EVP_MD_get_size(md);
 220     if (sz <= 0)
 221         return 0;
 222
 223     return sz;
 224 }
 225
 226 #ifdef FIPS_MODULE
 227 static int fips_hkdf_key_check_passed(KDF_HKDF *ctx)
 228 {
 229     OSSL_LIB_CTX *libctx = PROV_LIBCTX_OF(ctx->provctx);
 230     int key_approved = ossl_kdf_check_key_size(ctx->key_len);
 231
 232     if (!key_approved) {
 233         if (!OSSL_FIPS_IND_ON_UNAPPROVED(ctx, OSSL_FIPS_IND_SETTABLE0,
 234                                          libctx, "HKDF", "Key size",
 235                                          ossl_fips_config_hkdf_key_check)) {
 236             ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_KEY_LENGTH);
 237             return 0;
 238         }
 239     }
 240     return 1;
 241 }
 242 #endif
 243
 244 static int kdf_hkdf_derive(void *vctx, unsigned char *key, size_t keylen,
 245                            const OSSL_PARAM params[])
 246 {
 247     KDF_HKDF *ctx = (KDF_HKDF *)vctx;
 248     OSSL_LIB_CTX *libctx = PROV_LIBCTX_OF(ctx->provctx);
 249     const EVP_MD *md;
 250
 251     if (!ossl_prov_is_running() || !kdf_hkdf_set_ctx_params(ctx, params))
 252         return 0;
 253
 254     md = ossl_prov_digest_md(&ctx->digest);
 255     if (md == NULL) {
 256         ERR_raise(ERR_LIB_PROV, PROV_R_MISSING_MESSAGE_DIGEST);
 257         return 0;
 258     }
 259     if (ctx->key == NULL) {
 260         ERR_raise(ERR_LIB_PROV, PROV_R_MISSING_KEY);
 261         return 0;
 262     }
 263     if (keylen == 0) {
 264         ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_KEY_LENGTH);
 265         return 0;
 266     }
 267
 268     switch (ctx->mode) {
 269     case EVP_KDF_HKDF_MODE_EXTRACT_AND_EXPAND:
 270     default:
 271         return HKDF(libctx, md, ctx->salt, ctx->salt_len,
 272                     ctx->key, ctx->key_len, ctx->info, ctx->info_len, key, keylen);
 273
 274     case EVP_KDF_HKDF_MODE_EXTRACT_ONLY:
 275         return HKDF_Extract(libctx, md, ctx->salt, ctx->salt_len,
 276                             ctx->key, ctx->key_len, key, keylen);
 277
 278     case EVP_KDF_HKDF_MODE_EXPAND_ONLY:
 279         return HKDF_Expand(md, ctx->key, ctx->key_len, ctx->info,
 280                            ctx->info_len, key, keylen);
 281     }
 282 }
 283
 284 static int hkdf_common_set_ctx_params(KDF_HKDF *ctx, const OSSL_PARAM params[])
 285 {
 286     OSSL_LIB_CTX *libctx = PROV_LIBCTX_OF(ctx->provctx);
 287     const OSSL_PARAM *p;
 288     int n;
 289
 290     if (ossl_param_is_empty(params))
 291         return 1;
 292
 293     if ((p = OSSL_PARAM_locate_const(params, OSSL_ALG_PARAM_DIGEST)) != NULL) {
 294         const EVP_MD *md = NULL;
 295
 296         if (ctx->fixed_digest) {
 297             ERR_raise_data(ERR_LIB_PROV, PROV_R_DIGEST_NOT_ALLOWED,
 298                            "Setting the digest is not supported for fixed-digest HKDFs");
 299             return 0;
 300         }
 301
 302         if (!ossl_prov_digest_load_from_params(&ctx->digest, params, libctx))
 303             return 0;
 304
 305         md = ossl_prov_digest_md(&ctx->digest);
 306         if (EVP_MD_xof(md)) {
 307             ERR_raise(ERR_LIB_PROV, PROV_R_XOF_DIGESTS_NOT_ALLOWED);
 308             return 0;
 309         }
 310     }
 311
 312     if ((p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_MODE)) != NULL) {
 313         if (p->data_type == OSSL_PARAM_UTF8_STRING) {
 314             if (OPENSSL_strcasecmp(p->data, "EXTRACT_AND_EXPAND") == 0) {
 315                 ctx->mode = EVP_KDF_HKDF_MODE_EXTRACT_AND_EXPAND;
 316             } else if (OPENSSL_strcasecmp(p->data, "EXTRACT_ONLY") == 0) {
 317                 ctx->mode = EVP_KDF_HKDF_MODE_EXTRACT_ONLY;
 318             } else if (OPENSSL_strcasecmp(p->data, "EXPAND_ONLY") == 0) {
 319                 ctx->mode = EVP_KDF_HKDF_MODE_EXPAND_ONLY;
 320             } else {
 321                 ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_MODE);
 322                 return 0;
 323             }
 324         } else if (OSSL_PARAM_get_int(p, &n)) {
 325             if (n != EVP_KDF_HKDF_MODE_EXTRACT_AND_EXPAND
 326                 && n != EVP_KDF_HKDF_MODE_EXTRACT_ONLY
 327                 && n != EVP_KDF_HKDF_MODE_EXPAND_ONLY) {
 328                 ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_MODE);
 329                 return 0;
 330             }
 331             ctx->mode = n;
 332         } else {
 333             ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_MODE);
 334             return 0;
 335         }
 336     }
 337
 338     if ((p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_KEY)) != NULL) {
 339         OPENSSL_clear_free(ctx->key, ctx->key_len);
 340         ctx->key = NULL;
 341         if (!OSSL_PARAM_get_octet_string(p, (void **)&ctx->key, 0,
 342                                          &ctx->key_len))
 343             return 0;
 344     }
 345
 346     if ((p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_SALT)) != NULL) {
 347         OPENSSL_free(ctx->salt);
 348         ctx->salt = NULL;
 349         if (!OSSL_PARAM_get_octet_string(p, (void **)&ctx->salt, 0,
 350                                          &ctx->salt_len))
 351             return 0;
 352     }
 353
 354     return 1;
 355 }
 356
 357 static int kdf_hkdf_set_ctx_params(void *vctx, const OSSL_PARAM params[])
 358 {
 359     KDF_HKDF *ctx = vctx;
 360
 361     if (ossl_param_is_empty(params))
 362         return 1;
 363
 364     if (!OSSL_FIPS_IND_SET_CTX_PARAM(ctx, OSSL_FIPS_IND_SETTABLE0, params,
 365                                      OSSL_KDF_PARAM_FIPS_KEY_CHECK))
 366         return 0;
 367
 368     if (!hkdf_common_set_ctx_params(ctx, params))
 369         return 0;
 370
 371     if (ossl_param_get1_concat_octet_string(params, OSSL_KDF_PARAM_INFO,
 372                                             &ctx->info, &ctx->info_len,
 373                                             HKDF_MAXINFO) == 0)
 374         return 0;
 375
 376 #ifdef FIPS_MODULE
 377     if (OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_KEY) != NULL)
 378         if (!fips_hkdf_key_check_passed(ctx))
 379             return 0;
 380 #endif
 381
 382     return 1;
 383 }
 384
 385 static const OSSL_PARAM *kdf_hkdf_settable_ctx_params(ossl_unused void *ctx,
 386                                                       ossl_unused void *provctx)
 387 {
 388     static const OSSL_PARAM known_settable_ctx_params[] = {
 389         HKDF_COMMON_SETTABLES,
 390         OSSL_PARAM_octet_string(OSSL_KDF_PARAM_INFO, NULL, 0),
 391         OSSL_FIPS_IND_SETTABLE_CTX_PARAM(OSSL_KDF_PARAM_FIPS_KEY_CHECK)
 392         OSSL_PARAM_END
 393     };
 394     return known_settable_ctx_params;
 395 }
 396
 397 static int hkdf_common_get_ctx_params(KDF_HKDF *ctx, OSSL_PARAM params[])
 398 {
 399     OSSL_PARAM *p;
 400
 401     if (ossl_param_is_empty(params))
 402         return 1;
 403
 404     if ((p = OSSL_PARAM_locate(params, OSSL_KDF_PARAM_SIZE)) != NULL) {
 405         size_t sz = kdf_hkdf_size(ctx);
 406
 407         if (sz == 0)
 408             return 0;
 409         if (!OSSL_PARAM_set_size_t(p, sz))
 410             return 0;
 411     }
 412
 413     if ((p = OSSL_PARAM_locate(params, OSSL_KDF_PARAM_DIGEST)) != NULL) {
 414         const EVP_MD *md = ossl_prov_digest_md(&ctx->digest);
 415
 416         if (md == NULL)
 417             return 0;
 418         else if (!OSSL_PARAM_set_utf8_string(p, EVP_MD_get0_name(md)))
 419             return 0;
 420     }
 421
 422     /* OSSL_KDF_PARAM_MODE has multiple parameter types, so look for all instances */
 423     p = params;
 424     while ((p = OSSL_PARAM_locate(p, OSSL_KDF_PARAM_MODE)) != NULL) {
 425         if (p->data_type == OSSL_PARAM_UTF8_STRING) {
 426             switch (ctx->mode) {
 427             case EVP_KDF_HKDF_MODE_EXTRACT_AND_EXPAND:
 428                 if (!OSSL_PARAM_set_utf8_string(p, "EXTRACT_AND_EXPAND"))
 429                     return 0;
 430                 break;
 431             case EVP_KDF_HKDF_MODE_EXTRACT_ONLY:
 432                 if (!OSSL_PARAM_set_utf8_string(p, "EXTRACT_ONLY"))
 433                     return 0;
 434                 break;
 435             case EVP_KDF_HKDF_MODE_EXPAND_ONLY:
 436                 if (!OSSL_PARAM_set_utf8_string(p, "EXPAND_ONLY"))
 437                     return 0;
 438                 break;
 439             default:
 440                 return 0;
 441             }
 442         } else if (p->data_type == OSSL_PARAM_INTEGER) {
 443             if (!OSSL_PARAM_set_int(p, ctx->mode))
 444                 return 0;
 445         }
 446         p++;
 447     }
 448
 449     if ((p = OSSL_PARAM_locate(params, OSSL_KDF_PARAM_SALT)) != NULL) {
 450         if (ctx->salt == NULL || ctx->salt_len == 0)
 451             p->return_size = 0;
 452         else if (!OSSL_PARAM_set_octet_string(p, ctx->salt, ctx->salt_len))
 453             return 0;
 454     }
 455
 456     if ((p = OSSL_PARAM_locate(params, OSSL_KDF_PARAM_INFO)) != NULL) {
 457         if (ctx->info == NULL || ctx->info_len == 0)
 458             p->return_size = 0;
 459         else if (!OSSL_PARAM_set_octet_string(p, ctx->info, ctx->info_len))
 460             return 0;
 461     }
 462
 463     return 1;
 464 }
 465
 466 static int kdf_hkdf_get_ctx_params(void *vctx, OSSL_PARAM params[])
 467 {
 468     KDF_HKDF *ctx = (KDF_HKDF *)vctx;
 469
 470     if (ossl_param_is_empty(params))
 471         return 1;
 472
 473     if (!hkdf_common_get_ctx_params(ctx, params))
 474         return 0;
 475
 476     if (!OSSL_FIPS_IND_GET_CTX_PARAM(ctx, params))
 477         return 0;
 478
 479     return 1;
 480 }
 481
 482 static const OSSL_PARAM *kdf_hkdf_gettable_ctx_params(ossl_unused void *ctx,
 483                                                       ossl_unused void *provctx)
 484 {
 485     static const OSSL_PARAM known_gettable_ctx_params[] = {
 486         HKDF_COMMON_GETTABLES,
 487         OSSL_FIPS_IND_GETTABLE_CTX_PARAM()
 488         OSSL_PARAM_END
 489     };
 490     return known_gettable_ctx_params;
 491 }
 492
 493 const OSSL_DISPATCH ossl_kdf_hkdf_functions[] = {
 494     { OSSL_FUNC_KDF_NEWCTX, (void(*)(void))kdf_hkdf_new },
 495     { OSSL_FUNC_KDF_DUPCTX, (void(*)(void))kdf_hkdf_dup },
 496     { OSSL_FUNC_KDF_FREECTX, (void(*)(void))kdf_hkdf_free },
 497     { OSSL_FUNC_KDF_RESET, (void(*)(void))kdf_hkdf_reset },
 498     { OSSL_FUNC_KDF_DERIVE, (void(*)(void))kdf_hkdf_derive },
 499     { OSSL_FUNC_KDF_SETTABLE_CTX_PARAMS,
 500       (void(*)(void))kdf_hkdf_settable_ctx_params },
 501     { OSSL_FUNC_KDF_SET_CTX_PARAMS, (void(*)(void))kdf_hkdf_set_ctx_params },
 502     { OSSL_FUNC_KDF_GETTABLE_CTX_PARAMS,
 503       (void(*)(void))kdf_hkdf_gettable_ctx_params },
 504     { OSSL_FUNC_KDF_GET_CTX_PARAMS, (void(*)(void))kdf_hkdf_get_ctx_params },
 505     OSSL_DISPATCH_END
 506 };
 507
 508 static void *kdf_hkdf_fixed_digest_new(void *provctx, const char *digest)
 509 {
 510     OSSL_LIB_CTX *libctx = PROV_LIBCTX_OF(provctx);
 511     KDF_HKDF *ctx;
 512     OSSL_PARAM params[2];
 513
 514     ctx = kdf_hkdf_new(provctx);
 515     if (ctx == NULL)
 516         return NULL;
 517
 518     params[0] = OSSL_PARAM_construct_utf8_string(OSSL_ALG_PARAM_DIGEST,
 519                                                  (char *)digest, 0);
 520     params[1] = OSSL_PARAM_construct_end();
 521     if (!ossl_prov_digest_load_from_params(&ctx->digest, params, libctx)) {
 522         kdf_hkdf_free(ctx);
 523         return NULL;
 524     }
 525
 526     /* Now the digest can no longer be changed */
 527     ctx->fixed_digest = 1;
 528
 529     return ctx;
 530 }
 531
 532 #define KDF_HKDF_FIXED_DIGEST_NEW(hashname, hashstring) \
 533     static void *kdf_hkdf_##hashname##_new(void *provctx) \
 534     { \
 535         return kdf_hkdf_fixed_digest_new(provctx, hashstring); \
 536     }
 537
 538 KDF_HKDF_FIXED_DIGEST_NEW(sha256, "SHA256")
 539 KDF_HKDF_FIXED_DIGEST_NEW(sha384, "SHA384")
 540 KDF_HKDF_FIXED_DIGEST_NEW(sha512, "SHA512")
 541
 542 #define MAKE_KDF_HKDF_FIXED_DIGEST_FUNCTIONS(hashname) \
 543     const OSSL_DISPATCH ossl_kdf_hkdf_##hashname##_functions[] = { \
 544         { OSSL_FUNC_KDF_NEWCTX, (void(*)(void))kdf_hkdf_##hashname##_new }, \
 545         { OSSL_FUNC_KDF_DUPCTX, (void(*)(void))kdf_hkdf_dup }, \
 546         { OSSL_FUNC_KDF_FREECTX, (void(*)(void))kdf_hkdf_free }, \
 547         { OSSL_FUNC_KDF_RESET, (void(*)(void))kdf_hkdf_reset }, \
 548         { OSSL_FUNC_KDF_DERIVE, (void(*)(void))kdf_hkdf_derive }, \
 549         { OSSL_FUNC_KDF_SETTABLE_CTX_PARAMS, (void(*)(void))kdf_hkdf_settable_ctx_params }, \
 550         { OSSL_FUNC_KDF_SET_CTX_PARAMS, (void(*)(void))kdf_hkdf_set_ctx_params }, \
 551         { OSSL_FUNC_KDF_GETTABLE_CTX_PARAMS, (void(*)(void))kdf_hkdf_gettable_ctx_params }, \
 552         { OSSL_FUNC_KDF_GET_CTX_PARAMS, (void(*)(void))kdf_hkdf_get_ctx_params }, \
 553         OSSL_DISPATCH_END \
 554     };
 555
 556 MAKE_KDF_HKDF_FIXED_DIGEST_FUNCTIONS(sha256)
 557 MAKE_KDF_HKDF_FIXED_DIGEST_FUNCTIONS(sha384)
 558 MAKE_KDF_HKDF_FIXED_DIGEST_FUNCTIONS(sha512)
 559
 560 /*
 561  * Refer to "HMAC-based Extract-and-Expand Key Derivation Function (HKDF)"
 562  * Section 2 (https://tools.ietf.org/html/rfc5869#section-2) and
 563  * "Cryptographic Extraction and Key Derivation: The HKDF Scheme"
 564  * Section 4.2 (https://eprint.iacr.org/2010/264.pdf).
 565  *
 566  * From the paper:
 567  *   The scheme HKDF is specified as:
 568  *     HKDF(XTS, SKM, CTXinfo, L) = K(1) | K(2) | ... | K(t)
 569  *
 570  *     where:
 571  *       SKM is source key material
 572  *       XTS is extractor salt (which may be null or constant)
 573  *       CTXinfo is context information (may be null)
 574  *       L is the number of key bits to be produced by KDF
 575  *       k is the output length in bits of the hash function used with HMAC
 576  *       t = ceil(L/k)
 577  *       the value K(t) is truncated to its first d = L mod k bits.
 578  *
 579  * From RFC 5869:
 580  *   2.2.  Step 1: Extract
 581  *     HKDF-Extract(salt, IKM) -> PRK
 582  *   2.3.  Step 2: Expand
 583  *     HKDF-Expand(PRK, info, L) -> OKM
 584  */
 585 static int HKDF(OSSL_LIB_CTX *libctx, const EVP_MD *evp_md,
 586                 const unsigned char *salt, size_t salt_len,
 587                 const unsigned char *ikm, size_t ikm_len,
 588                 const unsigned char *info, size_t info_len,
 589                 unsigned char *okm, size_t okm_len)
 590 {
 591     unsigned char prk[EVP_MAX_MD_SIZE];
 592     int ret, sz;
 593     size_t prk_len;
 594
 595     sz = EVP_MD_get_size(evp_md);
 596     if (sz <= 0)
 597         return 0;
 598     prk_len = (size_t)sz;
 599
 600     /* Step 1: HKDF-Extract(salt, IKM) -> PRK */
 601     if (!HKDF_Extract(libctx, evp_md,
 602                       salt, salt_len, ikm, ikm_len, prk, prk_len))
 603         return 0;
 604
 605     /* Step 2: HKDF-Expand(PRK, info, L) -> OKM */
 606     ret = HKDF_Expand(evp_md, prk, prk_len, info, info_len, okm, okm_len);
 607     OPENSSL_cleanse(prk, sizeof(prk));
 608
 609     return ret;
 610 }
 611
 612 /*
 613  * Refer to "HMAC-based Extract-and-Expand Key Derivation Function (HKDF)"
 614  * Section 2.2 (https://tools.ietf.org/html/rfc5869#section-2.2).
 615  *
 616  * 2.2.  Step 1: Extract
 617  *
 618  *   HKDF-Extract(salt, IKM) -> PRK
 619  *
 620  *   Options:
 621  *      Hash     a hash function; HashLen denotes the length of the
 622  *               hash function output in octets
 623  *
 624  *   Inputs:
 625  *      salt     optional salt value (a non-secret random value);
 626  *               if not provided, it is set to a string of HashLen zeros.
 627  *      IKM      input keying material
 628  *
 629  *   Output:
 630  *      PRK      a pseudorandom key (of HashLen octets)
 631  *
 632  *   The output PRK is calculated as follows:
 633  *
 634  *   PRK = HMAC-Hash(salt, IKM)
 635  */
 636 static int HKDF_Extract(OSSL_LIB_CTX *libctx, const EVP_MD *evp_md,
 637                         const unsigned char *salt, size_t salt_len,
 638                         const unsigned char *ikm, size_t ikm_len,
 639                         unsigned char *prk, size_t prk_len)
 640 {
 641     int sz = EVP_MD_get_size(evp_md);
 642
 643     if (sz <= 0)
 644         return 0;
 645     if (prk_len != (size_t)sz) {
 646         ERR_raise(ERR_LIB_PROV, PROV_R_WRONG_OUTPUT_BUFFER_SIZE);
 647         return 0;
 648     }
 649     /* calc: PRK = HMAC-Hash(salt, IKM) */
 650     return
 651         EVP_Q_mac(libctx, "HMAC", NULL, EVP_MD_get0_name(evp_md), NULL, salt,
 652                   salt_len, ikm, ikm_len, prk, EVP_MD_get_size(evp_md), NULL)
 653         != NULL;
 654 }
 655
 656 /*
 657  * Refer to "HMAC-based Extract-and-Expand Key Derivation Function (HKDF)"
 658  * Section 2.3 (https://tools.ietf.org/html/rfc5869#section-2.3).
 659  *
 660  * 2.3.  Step 2: Expand
 661  *
 662  *   HKDF-Expand(PRK, info, L) -> OKM
 663  *
 664  *   Options:
 665  *      Hash     a hash function; HashLen denotes the length of the
 666  *               hash function output in octets
 667  *
 668  *   Inputs:
 669  *      PRK      a pseudorandom key of at least HashLen octets
 670  *               (usually, the output from the extract step)
 671  *      info     optional context and application specific information
 672  *               (can be a zero-length string)
 673  *      L        length of output keying material in octets
 674  *               (<= 255*HashLen)
 675  *
 676  *   Output:
 677  *      OKM      output keying material (of L octets)
 678  *
 679  *   The output OKM is calculated as follows:
 680  *
 681  *   N = ceil(L/HashLen)
 682  *   T = T(1) | T(2) | T(3) | ... | T(N)
 683  *   OKM = first L octets of T
 684  *
 685  *   where:
 686  *   T(0) = empty string (zero length)
 687  *   T(1) = HMAC-Hash(PRK, T(0) | info | 0x01)
 688  *   T(2) = HMAC-Hash(PRK, T(1) | info | 0x02)
 689  *   T(3) = HMAC-Hash(PRK, T(2) | info | 0x03)
 690  *   ...
 691  *
 692  *   (where the constant concatenated to the end of each T(n) is a
 693  *   single octet.)
 694  */
 695 static int HKDF_Expand(const EVP_MD *evp_md,
 696                        const unsigned char *prk, size_t prk_len,
 697                        const unsigned char *info, size_t info_len,
 698                        unsigned char *okm, size_t okm_len)
 699 {
 700     HMAC_CTX *hmac;
 701     int ret = 0, sz;
 702     unsigned int i;
 703     unsigned char prev[EVP_MAX_MD_SIZE];
 704     size_t done_len = 0, dig_len, n;
 705
 706     sz = EVP_MD_get_size(evp_md);
 707     if (sz <= 0)
 708         return 0;
 709     dig_len = (size_t)sz;
 710
 711     /* calc: N = ceil(L/HashLen) */
 712     n = okm_len / dig_len;
 713     if (okm_len % dig_len)
 714         n++;
 715
 716     if (n > 255 || okm == NULL)
 717         return 0;
 718
 719     if ((hmac = HMAC_CTX_new()) == NULL)
 720         return 0;
 721
 722     if (!HMAC_Init_ex(hmac, prk, (int)prk_len, evp_md, NULL))
 723         goto err;
 724
 725     for (i = 1; i <= n; i++) {
 726         size_t copy_len;
 727         const unsigned char ctr = i;
 728
 729         /* calc: T(i) = HMAC-Hash(PRK, T(i - 1) | info | i) */
 730         if (i > 1) {
 731             if (!HMAC_Init_ex(hmac, NULL, 0, NULL, NULL))
 732                 goto err;
 733
 734             if (!HMAC_Update(hmac, prev, dig_len))
 735                 goto err;
 736         }
 737
 738         if (!HMAC_Update(hmac, info, info_len))
 739             goto err;
 740
 741         if (!HMAC_Update(hmac, &ctr, 1))
 742             goto err;
 743
 744         if (!HMAC_Final(hmac, prev, NULL))
 745             goto err;
 746
 747         copy_len = (dig_len > okm_len - done_len) ?
 748                        okm_len - done_len :
 749                        dig_len;
 750
 751         memcpy(okm + done_len, prev, copy_len);
 752
 753         done_len += copy_len;
 754     }
 755     ret = 1;
 756
 757  err:
 758     OPENSSL_cleanse(prev, sizeof(prev));
 759     HMAC_CTX_free(hmac);
 760     return ret;
 761 }
 762
 763 /*
 764  * TLS uses slight variations of the above and for FIPS validation purposes,
 765  * they need to be present here.
 766  * Refer to RFC 8446 section 7 for specific details.
 767  */
 768
 769 /*
 770  * Given a |secret|; a |label| of length |labellen|; and |data| of length
 771  * |datalen| (e.g. typically a hash of the handshake messages), derive a new
 772  * secret |outlen| bytes long and store it in the location pointed to be |out|.
 773  * The |data| value may be zero length. Returns 1 on success and 0 on failure.
 774  */
 775 static int prov_tls13_hkdf_expand(const EVP_MD *md,
 776                                   const unsigned char *key, size_t keylen,
 777                                   const unsigned char *prefix, size_t prefixlen,
 778                                   const unsigned char *label, size_t labellen,
 779                                   const unsigned char *data, size_t datalen,
 780                                   unsigned char *out, size_t outlen)
 781 {
 782     size_t hkdflabellen;
 783     unsigned char hkdflabel[HKDF_MAXBUF];
 784     WPACKET pkt;
 785
 786     /*
 787      * 2 bytes for length of derived secret + 1 byte for length of combined
 788      * prefix and label + bytes for the label itself + 1 byte length of hash
 789      * + bytes for the hash itself.  We've got the maximum the KDF can handle
 790      * which should always be sufficient.
 791      */
 792     if (!WPACKET_init_static_len(&pkt, hkdflabel, sizeof(hkdflabel), 0)
 793             || !WPACKET_put_bytes_u16(&pkt, outlen)
 794             || !WPACKET_start_sub_packet_u8(&pkt)
 795             || !WPACKET_memcpy(&pkt, prefix, prefixlen)
 796             || !WPACKET_memcpy(&pkt, label, labellen)
 797             || !WPACKET_close(&pkt)
 798             || !WPACKET_sub_memcpy_u8(&pkt, data, (data == NULL) ? 0 : datalen)
 799             || !WPACKET_get_total_written(&pkt, &hkdflabellen)
 800             || !WPACKET_finish(&pkt)) {
 801         WPACKET_cleanup(&pkt);
 802         return 0;
 803     }
 804
 805     return HKDF_Expand(md, key, keylen, hkdflabel, hkdflabellen,
 806                        out, outlen);
 807 }
 808
 809 static int prov_tls13_hkdf_generate_secret(OSSL_LIB_CTX *libctx,
 810                                            const EVP_MD *md,
 811                                            const unsigned char *prevsecret,
 812                                            size_t prevsecretlen,
 813                                            const unsigned char *insecret,
 814                                            size_t insecretlen,
 815                                            const unsigned char *prefix,
 816                                            size_t prefixlen,
 817                                            const unsigned char *label,
 818                                            size_t labellen,
 819                                            unsigned char *out, size_t outlen)
 820 {
 821     size_t mdlen;
 822     int ret;
 823     unsigned char preextractsec[EVP_MAX_MD_SIZE];
 824     /* Always filled with zeros */
 825     static const unsigned char default_zeros[EVP_MAX_MD_SIZE];
 826
 827     ret = EVP_MD_get_size(md);
 828     /* Ensure cast to size_t is safe */
 829     if (ret <= 0)
 830         return 0;
 831     mdlen = (size_t)ret;
 832
 833     if (insecret == NULL) {
 834         insecret = default_zeros;
 835         insecretlen = mdlen;
 836     }
 837     if (prevsecret == NULL) {
 838         prevsecret = default_zeros;
 839         prevsecretlen = mdlen;
 840     } else {
 841         EVP_MD_CTX *mctx = EVP_MD_CTX_new();
 842         unsigned char hash[EVP_MAX_MD_SIZE];
 843
 844         /* The pre-extract derive step uses a hash of no messages */
 845         if (mctx == NULL
 846                 || EVP_DigestInit_ex(mctx, md, NULL) <= 0
 847                 || EVP_DigestFinal_ex(mctx, hash, NULL) <= 0) {
 848             EVP_MD_CTX_free(mctx);
 849             return 0;
 850         }
 851         EVP_MD_CTX_free(mctx);
 852
 853         /* Generate the pre-extract secret */
 854         if (!prov_tls13_hkdf_expand(md, prevsecret, prevsecretlen,
 855                                     prefix, prefixlen, label, labellen,
 856                                     hash, mdlen, preextractsec, mdlen))
 857             return 0;
 858         prevsecret = preextractsec;
 859         prevsecretlen = mdlen;
 860     }
 861
 862     ret = HKDF_Extract(libctx, md, prevsecret, prevsecretlen,
 863                        insecret, insecretlen, out, outlen);
 864
 865     if (prevsecret == preextractsec)
 866         OPENSSL_cleanse(preextractsec, mdlen);
 867     return ret;
 868 }
 869
 870 #ifdef FIPS_MODULE
 871 static int fips_tls1_3_digest_check_passed(KDF_HKDF *ctx, const EVP_MD *md)
 872 {
 873     OSSL_LIB_CTX *libctx = PROV_LIBCTX_OF(ctx->provctx);
 874     /*
 875      * Perform digest check
 876      *
 877      * According to RFC 8446 appendix B.4, the valid hash functions are
 878      * specified in FIPS 180-4. However, it only lists SHA2-256 and SHA2-384 in
 879      * the table. ACVP also only lists the same set of hash functions.
 880      */
 881     int digest_unapproved = !EVP_MD_is_a(md, SN_sha256)
 882         && !EVP_MD_is_a(md, SN_sha384);
 883
 884     if (digest_unapproved) {
 885         if (!OSSL_FIPS_IND_ON_UNAPPROVED(ctx, OSSL_FIPS_IND_SETTABLE0,
 886                                          libctx, "TLS13 KDF", "Digest",
 887                                          ossl_fips_config_tls13_kdf_digest_check)) {
 888             ERR_raise(ERR_LIB_PROV, PROV_R_DIGEST_NOT_ALLOWED);
 889             return 0;
 890         }
 891     }
 892     return 1;
 893 }
 894
 895 /*
 896  * Calculate the correct length of the secret key.
 897  *
 898  * RFC 8446:
 899  *   If a given secret is not available, then the 0-value consisting of a
 900  *   string of Hash.length bytes set to zeros is used.
 901  */
 902 static size_t fips_tls1_3_key_size(KDF_HKDF *ctx)
 903 {
 904     const EVP_MD *md = ossl_prov_digest_md(&ctx->digest);
 905     size_t key_size = 0;
 906
 907     if (ctx->key != NULL)
 908         key_size = ctx->key_len;
 909     else if (md != NULL)
 910         key_size = EVP_MD_size(md);
 911
 912     return key_size;
 913 }
 914
 915 static int fips_tls1_3_key_check_passed(KDF_HKDF *ctx)
 916 {
 917     OSSL_LIB_CTX *libctx = PROV_LIBCTX_OF(ctx->provctx);
 918     int key_approved = ossl_kdf_check_key_size(fips_tls1_3_key_size(ctx));
 919
 920     if (!key_approved) {
 921         if (!OSSL_FIPS_IND_ON_UNAPPROVED(ctx, OSSL_FIPS_IND_SETTABLE1,
 922                                          libctx, "TLS13 KDF", "Key size",
 923                                          ossl_fips_config_tls13_kdf_key_check)) {
 924             ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_KEY_LENGTH);
 925             return 0;
 926         }
 927     }
 928     return 1;
 929 }
 930 #endif
 931
 932 static int kdf_tls1_3_derive(void *vctx, unsigned char *key, size_t keylen,
 933                              const OSSL_PARAM params[])
 934 {
 935     KDF_HKDF *ctx = (KDF_HKDF *)vctx;
 936     const EVP_MD *md;
 937
 938     if (!ossl_prov_is_running() || !kdf_tls1_3_set_ctx_params(ctx, params))
 939         return 0;
 940
 941     md = ossl_prov_digest_md(&ctx->digest);
 942     if (md == NULL) {
 943         ERR_raise(ERR_LIB_PROV, PROV_R_MISSING_MESSAGE_DIGEST);
 944         return 0;
 945     }
 946
 947     switch (ctx->mode) {
 948     default:
 949         return 0;
 950
 951     case EVP_KDF_HKDF_MODE_EXTRACT_ONLY:
 952         return prov_tls13_hkdf_generate_secret(PROV_LIBCTX_OF(ctx->provctx),
 953                                                md,
 954                                                ctx->salt, ctx->salt_len,
 955                                                ctx->key, ctx->key_len,
 956                                                ctx->prefix, ctx->prefix_len,
 957                                                ctx->label, ctx->label_len,
 958                                                key, keylen);
 959
 960     case EVP_KDF_HKDF_MODE_EXPAND_ONLY:
 961         return prov_tls13_hkdf_expand(md, ctx->key, ctx->key_len,
 962                                       ctx->prefix, ctx->prefix_len,
 963                                       ctx->label, ctx->label_len,
 964                                       ctx->data, ctx->data_len,
 965                                       key, keylen);
 966     }
 967 }
 968
 969 static int kdf_tls1_3_set_ctx_params(void *vctx, const OSSL_PARAM params[])
 970 {
 971     const OSSL_PARAM *p;
 972     KDF_HKDF *ctx = vctx;
 973
 974     if (ossl_param_is_empty(params))
 975         return 1;
 976
 977     if (!OSSL_FIPS_IND_SET_CTX_PARAM(ctx, OSSL_FIPS_IND_SETTABLE0, params,
 978                                      OSSL_KDF_PARAM_FIPS_DIGEST_CHECK))
 979         return 0;
 980     if (!OSSL_FIPS_IND_SET_CTX_PARAM(ctx, OSSL_FIPS_IND_SETTABLE1, params,
 981                                      OSSL_KDF_PARAM_FIPS_KEY_CHECK))
 982         return 0;
 983
 984     if (!hkdf_common_set_ctx_params(ctx, params))
 985         return 0;
 986
 987     if (ctx->mode == EVP_KDF_HKDF_MODE_EXTRACT_AND_EXPAND) {
 988         ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_MODE);
 989         return 0;
 990     }
 991
 992     if ((p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_PREFIX)) != NULL) {
 993         OPENSSL_free(ctx->prefix);
 994         ctx->prefix = NULL;
 995         if (!OSSL_PARAM_get_octet_string(p, (void **)&ctx->prefix, 0,
 996                                          &ctx->prefix_len))
 997             return 0;
 998     }
 999
1000     if ((p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_LABEL)) != NULL) {
1001         OPENSSL_free(ctx->label);
1002         ctx->label = NULL;
1003         if (!OSSL_PARAM_get_octet_string(p, (void **)&ctx->label, 0,
1004                                          &ctx->label_len))
1005             return 0;
1006     }
1007
1008     OPENSSL_clear_free(ctx->data, ctx->data_len);
1009     ctx->data = NULL;
1010     if ((p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_DATA)) != NULL
1011             && !OSSL_PARAM_get_octet_string(p, (void **)&ctx->data, 0,
1012                                             &ctx->data_len))
1013         return 0;
1014
1015 #ifdef FIPS_MODULE
1016     if (OSSL_PARAM_locate_const(params, OSSL_ALG_PARAM_DIGEST) != NULL) {
1017         const EVP_MD *md = ossl_prov_digest_md(&ctx->digest);
1018
1019         if (!fips_tls1_3_digest_check_passed(ctx, md))
1020             return 0;
1021     }
1022
1023     if ((p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_KEY)) != NULL)
1024         if (!fips_tls1_3_key_check_passed(ctx))
1025             return 0;
1026 #endif
1027
1028     return 1;
1029 }
1030
1031 static const OSSL_PARAM *kdf_tls1_3_settable_ctx_params(ossl_unused void *ctx,
1032                                                         ossl_unused void *provctx)
1033 {
1034     static const OSSL_PARAM known_settable_ctx_params[] = {
1035         HKDF_COMMON_SETTABLES,
1036         OSSL_PARAM_octet_string(OSSL_KDF_PARAM_PREFIX, NULL, 0),
1037         OSSL_PARAM_octet_string(OSSL_KDF_PARAM_LABEL, NULL, 0),
1038         OSSL_PARAM_octet_string(OSSL_KDF_PARAM_DATA, NULL, 0),
1039         OSSL_FIPS_IND_SETTABLE_CTX_PARAM(OSSL_KDF_PARAM_FIPS_DIGEST_CHECK)
1040         OSSL_FIPS_IND_SETTABLE_CTX_PARAM(OSSL_KDF_PARAM_FIPS_KEY_CHECK)
1041         OSSL_PARAM_END
1042     };
1043     return known_settable_ctx_params;
1044 }
1045
1046 static int kdf_tls1_3_get_ctx_params(void *vctx, OSSL_PARAM params[])
1047 {
1048     KDF_HKDF *ctx = (KDF_HKDF *)vctx;
1049
1050     if (ossl_param_is_empty(params))
1051         return 1;
1052
1053     if (!hkdf_common_get_ctx_params(ctx, params))
1054         return 0;
1055
1056     if (!OSSL_FIPS_IND_GET_CTX_PARAM(ctx, params))
1057         return 0;
1058
1059     return 1;
1060 }
1061
1062 static const OSSL_PARAM *kdf_tls1_3_gettable_ctx_params(ossl_unused void *ctx,
1063                                                         ossl_unused void *provctx)
1064 {
1065     static const OSSL_PARAM known_gettable_ctx_params[] = {
1066         HKDF_COMMON_GETTABLES,
1067         OSSL_FIPS_IND_GETTABLE_CTX_PARAM()
1068         OSSL_PARAM_END
1069     };
1070     return known_gettable_ctx_params;
1071 }
1072
1073 const OSSL_DISPATCH ossl_kdf_tls1_3_kdf_functions[] = {
1074     { OSSL_FUNC_KDF_NEWCTX, (void(*)(void))kdf_hkdf_new },
1075     { OSSL_FUNC_KDF_DUPCTX, (void(*)(void))kdf_hkdf_dup },
1076     { OSSL_FUNC_KDF_FREECTX, (void(*)(void))kdf_hkdf_free },
1077     { OSSL_FUNC_KDF_RESET, (void(*)(void))kdf_hkdf_reset },
1078     { OSSL_FUNC_KDF_DERIVE, (void(*)(void))kdf_tls1_3_derive },
1079     { OSSL_FUNC_KDF_SETTABLE_CTX_PARAMS,
1080       (void(*)(void))kdf_tls1_3_settable_ctx_params },
1081     { OSSL_FUNC_KDF_SET_CTX_PARAMS, (void(*)(void))kdf_tls1_3_set_ctx_params },
1082     { OSSL_FUNC_KDF_GETTABLE_CTX_PARAMS,
1083       (void(*)(void))kdf_tls1_3_gettable_ctx_params },
1084     { OSSL_FUNC_KDF_GET_CTX_PARAMS, (void(*)(void))kdf_tls1_3_get_ctx_params },
1085     OSSL_DISPATCH_END
1086 };