wolfcrypt/hkdf: does not conform to RFC 5869

[elagergren-spideroak]

RFC 5869 section 2.3 states that the length of the output is L <= 255*HashLen where HashLen is the size in octets of the the hash function's digest. However, wc_HKDF_Expand has no such limit:

wolfssl/wolfcrypt/src/hmac.c

Lines 1209 to 1252 in 5e45767

	int wc_HKDF_Expand(int type, const byte* inKey, word32 inKeySz,
	const byte* info, word32 infoSz, byte* out, word32 outSz)
	{
	byte tmp[WC_MAX_DIGEST_SIZE];
	Hmac myHmac;
	int ret = 0;
	word32 outIdx = 0;
	word32 hashSz = wc_HmacSizeByType(type);
	byte n = 0x1;
	ret = wc_HmacInit(&myHmac, NULL, INVALID_DEVID);
	if (ret != 0)
	return ret;
	while (outIdx < outSz) {
	int tmpSz = (n == 1) ? 0 : hashSz;
	word32 left = outSz - outIdx;
	ret = wc_HmacSetKey(&myHmac, type, inKey, inKeySz);
	if (ret != 0)
	break;
	ret = wc_HmacUpdate(&myHmac, tmp, tmpSz);
	if (ret != 0)
	break;
	ret = wc_HmacUpdate(&myHmac, info, infoSz);
	if (ret != 0)
	break;
	ret = wc_HmacUpdate(&myHmac, &n, 1);
	if (ret != 0)
	break;
	ret = wc_HmacFinal(&myHmac, tmp);
	if (ret != 0)
	break;
	left = min(left, hashSz);
	XMEMCPY(out+outIdx, tmp, left);
	outIdx += hashSz;
	n++;
	}
	wc_HmacFree(&myHmac);
	return ret;

Examples from other HKDF libraries:

1. Go: https://github.com/golang/crypto/blob/4b2356b1ed79e6be3deca3737a3db3d132d2847a/hkdf/hkdf.go#L49
2. OpenSSL: https://github.com/OneSignal/openssl/blob/0db957dbbcf6a432086ab913378c23636d8c374c/crypto/kdf/hkdf.c#L290-L297
3. Rust: https://github.com/RustCrypto/KDFs/blob/6c61c600ec03f02d36a301f320fe6a957711e6a7/hkdf/src/hkdf.rs#L108
4. Python: https://github.com/pyca/cryptography/blob/e05795897c7b723e134da5085fd60fa710fb5081/src/cryptography/hazmat/primitives/kdf/hkdf.py#L67-L73

[JacobBarthelmeh]

Closing this out with the fix in PR #2956 having been merged.

[JacobBarthelmeh]

Thanks @elagergren-spideroak for the report