KDF

[tarcieri]

It would be nice to support a KDF (or more than one) so long as it is parsimonious with the rest of the library, that is to say: based on the existing primitives supplied by the library, namely the AES block cipher and the PRFs CMAC and PMAC. Bonus points for a parallel construction.

Some options:

• Expose the S2V function as a KDF (with either CMAC or PMAC). This is the simplest and most parsimonious option.
• The CKDF construction (HKDF with CMAC as the hash function) as described in https://www.ietf.org/archive/id/draft-agl-ckdf-01.txt
• The ExtParallelC construction described in section 5.2.1 of https://datatracker.ietf.org/doc/draft-irtf-cfrg-re-keying/