dune-project

@@ -35,6 +35,7 @@
    bin
    angstrom
    mirage-crypto
+   kdf
    digestif
    duration
    jsont

mte.opam

@@ -22,6 +22,7 @@ depends: [
   "bin"
   "angstrom"
   "mirage-crypto"
+  "kdf"
   "digestif"
   "duration"
   "jsont"

src/crypto.ml

@@ -232,6 +232,16 @@ module RsaPublicKey = struct
       Caqti_type.octets
 end
 
+module Kdf = struct
+  module XTR = Hkdf.Make (Digestif.SHA512)
+  module PRF = Hkdf.Make (Digestif.SHA256)
+
+  let kdf ~salt ~ikm ~info ~len =
+    let prk = XTR.extract ~salt ikm in
+    let okm = PRF.expand ~prk ~info len in
+    okm
+end
+
 module RsaPrivateKey = struct
   open Mirage_crypto_pk.Rsa
 

src/dune

@@ -17,6 +17,7 @@
   caqti-driver-pgx
   bin
   mirage-crypto
+  kdf.hkdf
   digestif
   duration
   vif

test/crypto.ml

@@ -73,3 +73,24 @@ let () =
   in
 
   ()
+
+let () =
+  (* kdf *)
+  let salt = "94KPT83PCNS7J83KC5P78Y8" in
+  let ikm = "94KPT83MD1JJ0WV5CDS6AX10D5Q70XBM41NPAY90DNGQ8SBJD5GPR" in
+  let ctx =
+    "94KPT83141HPYVKMCNW78833D1TPWTSC41GPRWVF41NPWVVQDRG62WS04XMPWSKF4WG6JVH0EHM6A82J8S1G"
+  in
+  let out_len = 64 in
+  let out =
+    "GTMR4QT05Z9WF5HKVG0WK9RPXGHSMHJNW377G9GJXCA8B0FEKPF4D27RJMSJZYWSQNTBJ5EYVV7ZW18B48Z0JVJJ80RHB706Y96Q358"
+  in
+
+  let salt = salt |> decode in
+  let ikm = ikm |> decode in
+  let info = ctx |> decode in
+  let km = Crypto.Kdf.kdf ~salt ~ikm ~info ~len:out_len in
+  let km = km |> encode in
+  assert (km = out);
+
+  ()