Feature request: HMAC-based KBKDF counter mode (NIST SP 800-108r1 §4.1)

[MarkAtwood]

wolfSSL provides wc_KDA_KDF_PRF_cmac for CMAC-based KBKDF (NIST SP 800-108) but has no HMAC variant. The HMAC counter-mode variant (SP 800-108r1 §4.1) is required for interoperability with TLS, SSH, and JOSE, which specify KBKDF-CTR-HMAC rather than KBKDF-CTR-CMAC.

Workaround in use: SP 800-108r1 §4.1 counter-mode KDF implemented directly using wolfSSL's WOLFSSL_HMAC_CTX primitives: per-iteration counter as a 32-bit big-endian prefix concatenated with the caller-supplied FixedInfo, hashed with HMAC-SHA2.

Requested fix: Add wc_KBKDF_ctr_hmac (or extend wc_KDA_KDF_PRF to accept a MAC type selector) matching the existing CMAC variant. The HMAC and CMAC variants share the same counter-mode loop structure; the only difference is the PRF.

Migrated from internal tracking (ZD-21737).

[MarkAtwood]

Where this surfaces

This was discovered in wolfssl-rs, the Rust FFI wrapper for wolfCrypt.

~60 lines of C reimplementing SP 800-108r1 §4.1 in wolfcrypt-rs/src/compat_shim.c (lines 793–850):

/* wolfSSL does not yet provide an HMAC-based KBKDF. It has
 * wc_KDA_KDF_PRF_cmac (CMAC-based, SP 800-108) but not the HMAC
 * variant. This shim uses wolfSSL's HMAC primitives directly.
 * Replace with a native wolfSSL call when one becomes available. */

WOLFSSL_HMAC_CTX *ctx = wolfSSL_HMAC_CTX_new();
// ... iterates counter i=1,2,...
// K(i) = HMAC(key, [i]_4 || info)
wolfSSL_HMAC_Init_ex(ctx, key, (int)key_len, digest, NULL)

The Rust consumer is wolfcrypt-ring-compat/src/kdf/kbkdf.rs. This should be a one-liner call to a native wolfSSL function.