Add kdf module: Key Derivation Function API (JEP 510, final in JDK 25), HKDF, RFC 5869 vectors, interop with Python cryptography and openssl, per-tenant keys

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_017ic4b7rnC7jppGGdHGESvy
This commit is contained in:
2026-10-28 18:07:57 +00:00
co-authored by Claude Sonnet 5.5
parent c93a1fffbb
commit eca73ad544
21 changed files with 995 additions and 0 deletions
@@ -0,0 +1,19 @@
$ java -cp classes RefCheck (25.0.5+8-LTS)
== RefHkdf (HmacSHA256 only) on RFC 5869 A.1 basic
PASS PRK
PASS OKM
== RefHkdf (HmacSHA256 only) on RFC 5869 A.2 long inputs
PASS PRK
PASS OKM
== RefHkdf (HmacSHA256 only) on RFC 5869 A.3 empty salt and info
PASS PRK
PASS OKM
ALL CHECKS PASSED
exit=0
$ java -cp classes Interop interop/cases.tsv (25.0.5+8-LTS)
== interop/cases.tsv: 300 cases {SHA256=100, SHA384=100, SHA512=100}, longest output 16320 bytes
PASS JDK KDF API matches Python cryptography on 300 of 300
PASS hand-written RefHkdf matches Python cryptography on 300 of 300
ALL CHECKS PASSED
exit=0