tree ceded298c9da50ab040688ca82ea4e8bbcd0601b
parent d3f26f8af0853b4d337d2405281f91fdfbe64465
author Daniel McCarney <daniel@binaryparadox.net> 1735933373 -0500
committer Boringssl LUCI CQ <boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com> 1737412451 -0800

util/fipstools: support feedback KDF w/ empty IVs

The module wrapper I'm testing supports feedback mode KDF w/ HKDF using
an 8 bit counter and no IV. This commit updates the subprocess handling
for the KDF algorithm to support this use-case.

By offering feedback-mode support with empty IV only the diff is quite
minimal. Module wrappers are assumed to use a capability with
both "supportsEmptyIv":true and "requiresEmptyIv":true.

See the NIST KDF ACVP spec for more information:

  https://pages.nist.gov/ACVP/draft-celi-acvp-kbkdf.html

Change-Id: I30eb9d0e8bb88c793d05014e4d98e034675f13b6
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/74747
Reviewed-by: Adam Langley <agl@google.com>
Reviewed-by: Bob Beck <bbe@google.com>
Commit-Queue: Bob Beck <bbe@google.com>