1 /** @file
2 
3   Tests for HKDF
4 
5   @section license License
6 
7   Licensed to the Apache Software Foundation (ASF) under one
8   or more contributor license agreements.  See the NOTICE file
9   distributed with this work for additional information
10   regarding copyright ownership.  The ASF licenses this file
11   to you under the Apache License, Version 2.0 (the
12   "License"); you may not use this file except in compliance
13   with the License.  You may obtain a copy of the License at
14 
15       http://www.apache.org/licenses/LICENSE-2.0
16 
17   Unless required by applicable law or agreed to in writing, software
18   distributed under the License is distributed on an "AS IS" BASIS,
19   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
20   See the License for the specific language governing permissions and
21   limitations under the License.
22  */
23 
24 #include "catch.hpp"
25 #include <cstring>
26 #include "tscore/HKDF.h"
27 
28 TEST_CASE("HKDF tests", "[hkdf]")
29 {
30   SECTION("Basic test case with SHA-256")
31   {
32     uint8_t ikm[] = {
33       0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b,
34       0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b,
35     };
36     uint8_t salt[] = {
37       0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c,
38     };
39     uint8_t info[] = {
40       0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7, 0xf8, 0xf9,
41     };
42     uint16_t length        = 42;
43     uint8_t expected_prk[] = {
44       0x07, 0x77, 0x09, 0x36, 0x2c, 0x2e, 0x32, 0xdf, 0x0d, 0xdc, 0x3f, 0x0d, 0xc4, 0x7b, 0xba, 0x63,
45       0x90, 0xb6, 0xc7, 0x3b, 0xb5, 0x0f, 0x9c, 0x31, 0x22, 0xec, 0x84, 0x4a, 0xd7, 0xc2, 0xb3, 0xe5,
46     };
47     uint8_t expected_okm[] = {
48       0x3c, 0xb2, 0x5f, 0x25, 0xfa, 0xac, 0xd5, 0x7a, 0x90, 0x43, 0x4f, 0x64, 0xd0, 0x36, 0x2f, 0x2a, 0x2d, 0x2d, 0x0a, 0x90, 0xcf,
49       0x1a, 0x5a, 0x4c, 0x5d, 0xb0, 0x2d, 0x56, 0xec, 0xc4, 0xc5, 0xbf, 0x34, 0x00, 0x72, 0x08, 0xd5, 0xb8, 0x87, 0x18, 0x58, 0x65,
50     };
51 
52     uint8_t prk[256] = {0};
53     size_t prk_len   = sizeof(prk);
54     uint8_t okm[256] = {0};
55     size_t okm_len   = sizeof(okm);
56 
57     HKDF hkdf(EVP_sha256());
58 
59     // Extract
60     CHECK(hkdf.extract(prk, &prk_len, salt, sizeof(salt), ikm, sizeof(ikm)) == 1);
61     CHECK(prk_len == sizeof(expected_prk));
62     CHECK(memcmp(prk, expected_prk, sizeof(expected_prk)) == 0);
63 
64     // Expand
65     CHECK(hkdf.expand(okm, &okm_len, prk, prk_len, info, sizeof(info), length) == 1);
66     CHECK(okm_len == sizeof(expected_okm));
67     CHECK(memcmp(okm, expected_okm, sizeof(expected_okm)) == 0);
68   }
69 
70   SECTION("Test with SHA-256 and longer inputs/outputs")
71   {
72     uint8_t ikm[] = {
73       0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13,
74       0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f, 0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27,
75       0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f, 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x3a, 0x3b,
76       0x3c, 0x3d, 0x3e, 0x3f, 0x40, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47, 0x48, 0x49, 0x4a, 0x4b, 0x4c, 0x4d, 0x4e, 0x4f,
77     };
78     uint8_t salt[] = {
79       0x60, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e, 0x6f, 0x70, 0x71, 0x72, 0x73,
80       0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x7b, 0x7c, 0x7d, 0x7e, 0x7f, 0x80, 0x81, 0x82, 0x83, 0x84, 0x85, 0x86, 0x87,
81       0x88, 0x89, 0x8a, 0x8b, 0x8c, 0x8d, 0x8e, 0x8f, 0x90, 0x91, 0x92, 0x93, 0x94, 0x95, 0x96, 0x97, 0x98, 0x99, 0x9a, 0x9b,
82       0x9c, 0x9d, 0x9e, 0x9f, 0xa0, 0xa1, 0xa2, 0xa3, 0xa4, 0xa5, 0xa6, 0xa7, 0xa8, 0xa9, 0xaa, 0xab, 0xac, 0xad, 0xae, 0xaf,
83     };
84     uint8_t info[] = {
85       0xb0, 0xb1, 0xb2, 0xb3, 0xb4, 0xb5, 0xb6, 0xb7, 0xb8, 0xb9, 0xba, 0xbb, 0xbc, 0xbd, 0xbe, 0xbf, 0xc0, 0xc1, 0xc2, 0xc3,
86       0xc4, 0xc5, 0xc6, 0xc7, 0xc8, 0xc9, 0xca, 0xcb, 0xcc, 0xcd, 0xce, 0xcf, 0xd0, 0xd1, 0xd2, 0xd3, 0xd4, 0xd5, 0xd6, 0xd7,
87       0xd8, 0xd9, 0xda, 0xdb, 0xdc, 0xdd, 0xde, 0xdf, 0xe0, 0xe1, 0xe2, 0xe3, 0xe4, 0xe5, 0xe6, 0xe7, 0xe8, 0xe9, 0xea, 0xeb,
88       0xec, 0xed, 0xee, 0xef, 0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7, 0xf8, 0xf9, 0xfa, 0xfb, 0xfc, 0xfd, 0xfe, 0xff,
89     };
90     uint16_t length        = 82;
91     uint8_t expected_prk[] = {
92       0x06, 0xa6, 0xb8, 0x8c, 0x58, 0x53, 0x36, 0x1a, 0x06, 0x10, 0x4c, 0x9c, 0xeb, 0x35, 0xb4, 0x5c,
93       0xef, 0x76, 0x00, 0x14, 0x90, 0x46, 0x71, 0x01, 0x4a, 0x19, 0x3f, 0x40, 0xc1, 0x5f, 0xc2, 0x44,
94     };
95     uint8_t expected_okm[] = {
96       0xb1, 0x1e, 0x39, 0x8d, 0xc8, 0x03, 0x27, 0xa1, 0xc8, 0xe7, 0xf7, 0x8c, 0x59, 0x6a, 0x49, 0x34, 0x4f, 0x01, 0x2e, 0xda, 0x2d,
97       0x4e, 0xfa, 0xd8, 0xa0, 0x50, 0xcc, 0x4c, 0x19, 0xaf, 0xa9, 0x7c, 0x59, 0x04, 0x5a, 0x99, 0xca, 0xc7, 0x82, 0x72, 0x71, 0xcb,
98       0x41, 0xc6, 0x5e, 0x59, 0x0e, 0x09, 0xda, 0x32, 0x75, 0x60, 0x0c, 0x2f, 0x09, 0xb8, 0x36, 0x77, 0x93, 0xa9, 0xac, 0xa3, 0xdb,
99       0x71, 0xcc, 0x30, 0xc5, 0x81, 0x79, 0xec, 0x3e, 0x87, 0xc1, 0x4c, 0x01, 0xd5, 0xc1, 0xf3, 0x43, 0x4f, 0x1d, 0x87,
100     };
101 
102     uint8_t prk[256] = {0};
103     size_t prk_len   = sizeof(prk);
104     uint8_t okm[256] = {0};
105     size_t okm_len   = sizeof(okm);
106 
107     HKDF hkdf(EVP_sha256());
108 
109     // Extract
110     CHECK(hkdf.extract(prk, &prk_len, salt, sizeof(salt), ikm, sizeof(ikm)) == 1);
111     CHECK(prk_len == sizeof(expected_prk));
112     CHECK(memcmp(prk, expected_prk, sizeof(expected_prk)) == 0);
113 
114     // Expand
115     CHECK(hkdf.expand(okm, &okm_len, prk, prk_len, info, sizeof(info), length) == 1);
116     CHECK(okm_len == sizeof(expected_okm));
117     CHECK(memcmp(okm, expected_okm, sizeof(expected_okm)) == 0);
118   }
119 
120   SECTION("Test with SHA-256 and zero-length salt/info")
121   {
122     uint8_t ikm[] = {
123       0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b,
124       0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b,
125     };
126     uint8_t salt[]         = {};
127     uint8_t info[]         = {};
128     uint16_t length        = 42;
129     uint8_t expected_prk[] = {
130       0x19, 0xef, 0x24, 0xa3, 0x2c, 0x71, 0x7b, 0x16, 0x7f, 0x33, 0xa9, 0x1d, 0x6f, 0x64, 0x8b, 0xdf,
131       0x96, 0x59, 0x67, 0x76, 0xaf, 0xdb, 0x63, 0x77, 0xac, 0x43, 0x4c, 0x1c, 0x29, 0x3c, 0xcb, 0x04,
132     };
133     uint8_t expected_okm[] = {
134       0x8d, 0xa4, 0xe7, 0x75, 0xa5, 0x63, 0xc1, 0x8f, 0x71, 0x5f, 0x80, 0x2a, 0x06, 0x3c, 0x5a, 0x31, 0xb8, 0xa1, 0x1f, 0x5c, 0x5e,
135       0xe1, 0x87, 0x9e, 0xc3, 0x45, 0x4e, 0x5f, 0x3c, 0x73, 0x8d, 0x2d, 0x9d, 0x20, 0x13, 0x95, 0xfa, 0xa4, 0xb6, 0x1a, 0x96, 0xc8,
136     };
137 
138     uint8_t prk[256] = {0};
139     size_t prk_len   = sizeof(prk);
140     uint8_t okm[256] = {0};
141     size_t okm_len   = sizeof(okm);
142 
143     HKDF hkdf(EVP_sha256());
144 
145     // Extract
146     CHECK(hkdf.extract(prk, &prk_len, salt, sizeof(salt), ikm, sizeof(ikm)) == 1);
147     CHECK(prk_len == sizeof(expected_prk));
148     CHECK(memcmp(prk, expected_prk, sizeof(expected_prk)) == 0);
149 
150     // Expand
151     CHECK(hkdf.expand(okm, &okm_len, prk, prk_len, info, sizeof(info), length) == 1);
152     CHECK(okm_len == sizeof(expected_okm));
153     CHECK(memcmp(okm, expected_okm, sizeof(expected_okm)) == 0);
154   }
155 
156   SECTION("Basic test case with SHA-1")
157   {
158     uint8_t ikm[] = {
159       0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b,
160     };
161     uint8_t salt[] = {
162       0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c,
163     };
164     uint8_t info[] = {
165       0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7, 0xf8, 0xf9,
166     };
167     uint16_t length        = 42;
168     uint8_t expected_prk[] = {
169       0x9b, 0x6c, 0x18, 0xc4, 0x32, 0xa7, 0xbf, 0x8f, 0x0e, 0x71, 0xc8, 0xeb, 0x88, 0xf4, 0xb3, 0x0b, 0xaa, 0x2b, 0xa2, 0x43,
170     };
171     uint8_t expected_okm[] = {
172       0x08, 0x5a, 0x01, 0xea, 0x1b, 0x10, 0xf3, 0x69, 0x33, 0x06, 0x8b, 0x56, 0xef, 0xa5, 0xad, 0x81, 0xa4, 0xf1, 0x4b, 0x82, 0x2f,
173       0x5b, 0x09, 0x15, 0x68, 0xa9, 0xcd, 0xd4, 0xf1, 0x55, 0xfd, 0xa2, 0xc2, 0x2e, 0x42, 0x24, 0x78, 0xd3, 0x05, 0xf3, 0xf8, 0x96,
174     };
175 
176     uint8_t prk[256] = {0};
177     size_t prk_len   = sizeof(prk);
178     uint8_t okm[256] = {0};
179     size_t okm_len   = sizeof(okm);
180 
181     HKDF hkdf(EVP_sha1());
182 
183     // Extract
184     CHECK(hkdf.extract(prk, &prk_len, salt, sizeof(salt), ikm, sizeof(ikm)) == 1);
185     CHECK(prk_len == sizeof(expected_prk));
186     CHECK(memcmp(prk, expected_prk, sizeof(expected_prk)) == 0);
187 
188     // Expand
189     CHECK(hkdf.expand(okm, &okm_len, prk, prk_len, info, sizeof(info), length) == 1);
190     CHECK(okm_len == sizeof(expected_okm));
191     CHECK(memcmp(okm, expected_okm, sizeof(expected_okm)) == 0);
192   }
193 
194   SECTION("Test with SHA-1 and longer inputs/outputs")
195   {
196     uint8_t ikm[] = {
197       0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13,
198       0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f, 0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27,
199       0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f, 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x3a, 0x3b,
200       0x3c, 0x3d, 0x3e, 0x3f, 0x40, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47, 0x48, 0x49, 0x4a, 0x4b, 0x4c, 0x4d, 0x4e, 0x4f,
201     };
202     uint8_t salt[] = {
203       0x60, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e, 0x6f, 0x70, 0x71, 0x72, 0x73,
204       0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x7b, 0x7c, 0x7d, 0x7e, 0x7f, 0x80, 0x81, 0x82, 0x83, 0x84, 0x85, 0x86, 0x87,
205       0x88, 0x89, 0x8a, 0x8b, 0x8c, 0x8d, 0x8e, 0x8f, 0x90, 0x91, 0x92, 0x93, 0x94, 0x95, 0x96, 0x97, 0x98, 0x99, 0x9a, 0x9b,
206       0x9c, 0x9d, 0x9e, 0x9f, 0xa0, 0xa1, 0xa2, 0xa3, 0xa4, 0xa5, 0xa6, 0xa7, 0xa8, 0xa9, 0xaa, 0xab, 0xac, 0xad, 0xae, 0xaf,
207     };
208     uint8_t info[] = {
209       0xb0, 0xb1, 0xb2, 0xb3, 0xb4, 0xb5, 0xb6, 0xb7, 0xb8, 0xb9, 0xba, 0xbb, 0xbc, 0xbd, 0xbe, 0xbf, 0xc0, 0xc1, 0xc2, 0xc3,
210       0xc4, 0xc5, 0xc6, 0xc7, 0xc8, 0xc9, 0xca, 0xcb, 0xcc, 0xcd, 0xce, 0xcf, 0xd0, 0xd1, 0xd2, 0xd3, 0xd4, 0xd5, 0xd6, 0xd7,
211       0xd8, 0xd9, 0xda, 0xdb, 0xdc, 0xdd, 0xde, 0xdf, 0xe0, 0xe1, 0xe2, 0xe3, 0xe4, 0xe5, 0xe6, 0xe7, 0xe8, 0xe9, 0xea, 0xeb,
212       0xec, 0xed, 0xee, 0xef, 0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7, 0xf8, 0xf9, 0xfa, 0xfb, 0xfc, 0xfd, 0xfe, 0xff,
213     };
214     uint16_t length        = 82;
215     uint8_t expected_prk[] = {0x8a, 0xda, 0xe0, 0x9a, 0x2a, 0x30, 0x70, 0x59, 0x47, 0x8d,
216                               0x30, 0x9b, 0x26, 0xc4, 0x11, 0x5a, 0x22, 0x4c, 0xfa, 0xf6};
217     uint8_t expected_okm[] = {
218       0x0b, 0xd7, 0x70, 0xa7, 0x4d, 0x11, 0x60, 0xf7, 0xc9, 0xf1, 0x2c, 0xd5, 0x91, 0x2a, 0x06, 0xeb, 0xff, 0x6a, 0xdc, 0xae, 0x89,
219       0x9d, 0x92, 0x19, 0x1f, 0xe4, 0x30, 0x56, 0x73, 0xba, 0x2f, 0xfe, 0x8f, 0xa3, 0xf1, 0xa4, 0xe5, 0xad, 0x79, 0xf3, 0xf3, 0x34,
220       0xb3, 0xb2, 0x02, 0xb2, 0x17, 0x3c, 0x48, 0x6e, 0xa3, 0x7c, 0xe3, 0xd3, 0x97, 0xed, 0x03, 0x4c, 0x7f, 0x9d, 0xfe, 0xb1, 0x5c,
221       0x5e, 0x92, 0x73, 0x36, 0xd0, 0x44, 0x1f, 0x4c, 0x43, 0x00, 0xe2, 0xcf, 0xf0, 0xd0, 0x90, 0x0b, 0x52, 0xd3, 0xb4,
222     };
223 
224     uint8_t prk[256] = {0};
225     size_t prk_len   = sizeof(prk);
226     uint8_t okm[256] = {0};
227     size_t okm_len   = sizeof(okm);
228 
229     HKDF hkdf(EVP_sha1());
230 
231     // Extract
232     CHECK(hkdf.extract(prk, &prk_len, salt, sizeof(salt), ikm, sizeof(ikm)) == 1);
233     CHECK(prk_len == sizeof(expected_prk));
234     CHECK(memcmp(prk, expected_prk, sizeof(expected_prk)) == 0);
235 
236     // Expand
237     CHECK(hkdf.expand(okm, &okm_len, prk, prk_len, info, sizeof(info), length) == 1);
238     CHECK(okm_len == sizeof(expected_okm));
239     CHECK(memcmp(okm, expected_okm, sizeof(expected_okm)) == 0);
240   }
241 
242   SECTION("Test with SHA-1 and zero-length salt/info")
243   {
244     uint8_t ikm[] = {
245       0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b,
246       0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b,
247     };
248     uint8_t salt[]         = {};
249     uint8_t info[]         = {};
250     uint16_t length        = 42;
251     uint8_t expected_prk[] = {
252       0xda, 0x8c, 0x8a, 0x73, 0xc7, 0xfa, 0x77, 0x28, 0x8e, 0xc6, 0xf5, 0xe7, 0xc2, 0x97, 0x78, 0x6a, 0xa0, 0xd3, 0x2d, 0x01,
253     };
254     uint8_t expected_okm[] = {
255       0x0a, 0xc1, 0xaf, 0x70, 0x02, 0xb3, 0xd7, 0x61, 0xd1, 0xe5, 0x52, 0x98, 0xda, 0x9d, 0x05, 0x06, 0xb9, 0xae, 0x52, 0x05, 0x72,
256       0x20, 0xa3, 0x06, 0xe0, 0x7b, 0x6b, 0x87, 0xe8, 0xdf, 0x21, 0xd0, 0xea, 0x00, 0x03, 0x3d, 0xe0, 0x39, 0x84, 0xd3, 0x49, 0x18,
257     };
258 
259     uint8_t prk[256] = {0};
260     size_t prk_len   = sizeof(prk);
261     uint8_t okm[256] = {0};
262     size_t okm_len   = sizeof(okm);
263 
264     HKDF hkdf(EVP_sha1());
265 
266     // Extract
267     CHECK(hkdf.extract(prk, &prk_len, salt, sizeof(salt), ikm, sizeof(ikm)) == 1);
268     CHECK(prk_len == sizeof(expected_prk));
269     CHECK(memcmp(prk, expected_prk, sizeof(expected_prk)) == 0);
270 
271     // Expand
272     CHECK(hkdf.expand(okm, &okm_len, prk, prk_len, info, sizeof(info), length) == 1);
273     CHECK(okm_len == sizeof(expected_okm));
274     CHECK(memcmp(okm, expected_okm, sizeof(expected_okm)) == 0);
275   }
276 
277   SECTION("Test with SHA-1, salt not provided (defaults to HashLen zero octets)")
278   {
279     uint8_t ikm[] = {
280       0x0c, 0x0c, 0x0c, 0x0c, 0x0c, 0x0c, 0x0c, 0x0c, 0x0c, 0x0c, 0x0c,
281       0x0c, 0x0c, 0x0c, 0x0c, 0x0c, 0x0c, 0x0c, 0x0c, 0x0c, 0x0c, 0x0c,
282     };
283     uint8_t salt[]         = {};
284     uint8_t info[]         = {};
285     uint16_t length        = 42;
286     uint8_t expected_prk[] = {
287       0x2a, 0xdc, 0xca, 0xda, 0x18, 0x77, 0x9e, 0x7c, 0x20, 0x77, 0xad, 0x2e, 0xb1, 0x9d, 0x3f, 0x3e, 0x73, 0x13, 0x85, 0xdd,
288     };
289     uint8_t expected_okm[] = {
290       0x2c, 0x91, 0x11, 0x72, 0x04, 0xd7, 0x45, 0xf3, 0x50, 0x0d, 0x63, 0x6a, 0x62, 0xf6, 0x4f, 0x0a, 0xb3, 0xba, 0xe5, 0x48, 0xaa,
291       0x53, 0xd4, 0x23, 0xb0, 0xd1, 0xf2, 0x7e, 0xbb, 0xa6, 0xf5, 0xe5, 0x67, 0x3a, 0x08, 0x1d, 0x70, 0xcc, 0xe7, 0xac, 0xfc, 0x48,
292     };
293 
294     uint8_t prk[256] = {0};
295     size_t prk_len   = sizeof(prk);
296     uint8_t okm[256] = {0};
297     size_t okm_len   = sizeof(okm);
298 
299     HKDF hkdf(EVP_sha1());
300 
301     // Extract
302     CHECK(hkdf.extract(prk, &prk_len, salt, sizeof(salt), ikm, sizeof(ikm)) == 1);
303     CHECK(prk_len == sizeof(expected_prk));
304     CHECK(memcmp(prk, expected_prk, sizeof(expected_prk)) == 0);
305 
306     // Expand
307     CHECK(hkdf.expand(okm, &okm_len, prk, prk_len, info, sizeof(info), length) == 1);
308     CHECK(okm_len == sizeof(expected_okm));
309     CHECK(memcmp(okm, expected_okm, sizeof(expected_okm)) == 0);
310   }
311 }
312