Add support for KDFs based on SP 800-108 recommendations

[athoelke]

Define algorithm identifiers for HMAC and CMAC variants of a counter-mode KDF that follows the construction recommended by NIST SP 800-108r1.

As the specification defines a general construction, the Crypto API specification provides a precise definition, to ensure compatibility between different implementations. See #106 for the enhancement request, and discussion.

Fixes #106

[athoelke]

@adeaarm @Vge0rge - please review this PR.

[athoelke]

Rebased to merge with changes from #91, and added cross-references from the key types to the new algorithms

[Vge0rge]

@athoelke Do you think that it has value to provide a reference implementation of these new algorithms using the PSA crypto MAC APIS? These can can be used to generate test vectors which future implementations can use to verify that they follow the algorithm as we intend it to be followed.

I think that it is a good idea to have them, if you agree let me know what is the most suitable place to put them and I can provide the code for them.

[gilles-peskine-arm]

@Vge0rge We will implement this KDF in Mbed TLS, likely in our next release, so that can serve as sample code. With respect to test vectors, we'll likely generate our test data with Cryptodome.

[bheeb]

Cryptodome cannot be used to generate test vectors for PSA_ALG_SP800_108_COUNTER_CMAC because it implements the standard version, not the ‘robust’ variant suggested in these PR. The same holds for OpenSSL.

[athoelke]

Cryptodome cannot be used to generate test vectors for PSA_ALG_SP800_108_COUNTER_CMAC because it implements the standard version, not the ‘robust’ variant suggested in these PR. The same holds for OpenSSL.

I guess it would be possible to use CMAC-AES in Cryptodome to construct the CMAC-based KDF defined here, in order to create test vectors; as the SP800-108 Counter KDF support in Cryptodome uses a different construction?

However, I think a reference would be valuable. Whether for constructing or validating text vectors, or just helping to illustrate the construction defined in the Crypto API.

let me know what is the most suitable place to put them and I can provide the code for them.

My suggestion for hosting such examples would be to place it in a new /examples folder in this repository. Perhaps:

/examples/crypto/a-good-name-for-the-example/

containing a readme.md to briefly describe the example, and any source files?

[Vge0rge]

Sounds reasonable to me, I will arrange this soon then.

[gilles-peskine-arm]

A few local remarks, other than that LGTM.

Reviewer is happy to proceed once comments addressed

[adeaarm]

@Vge0rge We will implement this KDF in Mbed TLS, likely in our next release, so that can serve as sample code. With respect to test vectors, we'll likely generate our test data with Cryptodome.

Is this available in any Mbed TLS released version at the moment? If not, is it being worked on currently?