synta-certificate 0.2.6

//! Symmetric crypto traits and constant-time comparison.

use super::errors::{NoCryptoError, PrivateKeyError};

// ── HKDF output-length helper ─────────────────────────────────────────────────

/// Return the HMAC output length in bytes for a named digest algorithm.
///
/// Returns `None` for unknown algorithm names.  Used internally by
/// [`hkdf_extract`] and [`hkdf_expand`] to size the default salt and to
/// bound the number of expand rounds.
pub fn hmac_output_len(algorithm: &str) -> Option<usize> {
    match algorithm {
        "md5" => Some(16),
        "sha1" => Some(20),
        "sha224" => Some(28),
        "sha256" => Some(32),
        "sha384" => Some(48),
        "sha512" => Some(64),
        _ => None,
    }
}

// ── Constant-time comparison ──────────────────────────────────────────────────

/// Constant-time byte comparison.  Prevents timing side-channels.
///
/// XOR-accumulates all byte differences without any branch or early exit.
/// A backend-aware implementation is available through
/// [`HmacProvider::constant_time_eq`]; this free function is for callers
/// that do not have a backend instance.
pub fn constant_time_eq(a: &[u8], b: &[u8]) -> bool {
    if a.len() != b.len() {
        return false;
    }
    a.iter()
        .zip(b.iter())
        .fold(0u8, |acc, (x, y)| acc | (x ^ y))
        == 0
}

// ── Symmetric crypto traits ───────────────────────────────────────────────────

/// Hash arbitrary data with a named digest algorithm.
pub trait DataHasher {
    type Error: std::error::Error + Send + Sync + 'static;

    /// Hash `data` using the algorithm named by `algorithm` (e.g. `"sha256"`).
    ///
    /// Returns the raw digest bytes on success.
    fn hash_data(&self, algorithm: &str, data: &[u8]) -> Result<Vec<u8>, Self::Error>;
}

/// HMAC computation and constant-time verification.
pub trait HmacProvider {
    type Error: std::error::Error + Send + Sync + 'static;

    /// Compute HMAC of `data` under `key` using the given `algorithm`
    /// (e.g. `"sha256"`).  Returns the MAC bytes.
    fn hmac_compute(
        &self,
        algorithm: &str,
        key: &[u8],
        data: &[u8],
    ) -> Result<Vec<u8>, Self::Error>;

    /// Verify that HMAC of `data` under `key` equals `expected`.
    ///
    /// Implementations must compare in constant time to prevent timing attacks.
    /// Returns `Ok(())` if the MAC matches, or an error otherwise.
    fn hmac_verify(
        &self,
        algorithm: &str,
        key: &[u8],
        data: &[u8],
        expected: &[u8],
    ) -> Result<(), Self::Error>;

    /// Constant-time comparison of two byte slices.
    ///
    /// Returns `true` iff `a` and `b` have equal length and identical bytes,
    /// without leaking information through execution time.
    ///
    /// The default implementation uses XOR accumulation.  Backends may
    /// override with a formally-verified or hardware-accelerated alternative
    /// (e.g. `openssl::memcmp::eq`).
    fn constant_time_eq(&self, a: &[u8], b: &[u8]) -> bool {
        constant_time_eq(a, b)
    }
}

/// PBKDF2 (RFC 8018 §5.2) key derivation with HMAC-based PRF.
pub trait Pbkdf2Provider {
    type Error: std::error::Error + Send + Sync + 'static;

    /// Derive `length` bytes from `password` and `salt` using PBKDF2-HMAC
    /// with the named `algorithm` (e.g. `"sha256"`) and `iterations` rounds.
    ///
    /// Returns the derived key bytes.
    fn pbkdf2_hmac(
        &self,
        algorithm: &str,
        password: &[u8],
        salt: &[u8],
        iterations: usize,
        length: usize,
    ) -> Result<Vec<u8>, Self::Error>;
}

/// AES-CBC, AES-GCM, and Triple-DES-CBC block-cipher encryption and decryption.
pub trait BlockCipherProvider {
    type Error: std::error::Error + Send + Sync + 'static;

    /// Encrypt `plaintext` with AES-CBC under `key` and `iv`.
    ///
    /// When `pad` is `true` the plaintext is PKCS#7-padded to a block
    /// boundary before encryption.
    fn aes_cbc_encrypt(
        &self,
        key: &[u8],
        iv: &[u8],
        plaintext: &[u8],
        pad: bool,
    ) -> Result<Vec<u8>, Self::Error>;

    /// Decrypt `ciphertext` with AES-CBC under `key` and `iv`.
    ///
    /// When `unpad` is `true` trailing PKCS#7 padding is stripped after
    /// decryption.
    fn aes_cbc_decrypt(
        &self,
        key: &[u8],
        iv: &[u8],
        ciphertext: &[u8],
        unpad: bool,
    ) -> Result<Vec<u8>, Self::Error>;

    /// Encrypt `plaintext` with Triple-DES-EDE-CBC under `key` and `iv`.
    ///
    /// When `pad` is `true` the plaintext is PKCS#7-padded before encryption.
    fn des3_cbc_encrypt(
        &self,
        key: &[u8],
        iv: &[u8],
        plaintext: &[u8],
        pad: bool,
    ) -> Result<Vec<u8>, Self::Error>;

    /// Decrypt `ciphertext` with Triple-DES-EDE-CBC under `key` and `iv`.
    ///
    /// When `unpad` is `true` trailing PKCS#7 padding is stripped after
    /// decryption.
    fn des3_cbc_decrypt(
        &self,
        key: &[u8],
        iv: &[u8],
        ciphertext: &[u8],
        unpad: bool,
    ) -> Result<Vec<u8>, Self::Error>;

    /// Encrypt `plaintext` with AES-GCM under `key` and `nonce`.
    ///
    /// `key` must be 16, 24, or 32 bytes; `nonce` must be 12 bytes.
    /// `aad` is additional authenticated data and may be empty.
    /// Returns `ciphertext ‖ tag` where the tag is 16 bytes.
    fn aes_gcm_encrypt(
        &self,
        key: &[u8],
        nonce: &[u8],
        plaintext: &[u8],
        aad: &[u8],
    ) -> Result<Vec<u8>, Self::Error>;

    /// Decrypt and verify `ciphertext_with_tag` with AES-GCM.
    ///
    /// The last 16 bytes of `ciphertext_with_tag` are the authentication tag.
    /// Returns `Err` if the tag does not match or the inputs are invalid.
    fn aes_gcm_decrypt(
        &self,
        key: &[u8],
        nonce: &[u8],
        ciphertext_with_tag: &[u8],
        aad: &[u8],
    ) -> Result<Vec<u8>, Self::Error>;
}

/// Cryptographically secure pseudo-random byte generation.
pub trait SecureRandom {
    type Error: std::error::Error + Send + Sync + 'static;

    /// Fill `out` with cryptographically secure random bytes.
    fn rand_bytes(&self, out: &mut [u8]) -> Result<(), Self::Error>;
}

// ── StreamingHasher ───────────────────────────────────────────────────────────

/// A live streaming hash computation.
///
/// Created by [`StreamingHasher::new_hash`]; data is fed in with
/// [`update`]; the final digest is produced by [`finalize_boxed`].
///
/// `finalize_boxed` takes `Box<Self>` rather than `self` so that the trait is
/// object-safe and the state can be stored behind `Box<dyn HashState>`.
///
/// [`update`]: HashState::update
/// [`finalize_boxed`]: HashState::finalize_boxed
pub trait HashState: Send {
    /// Feed `data` into the running hash.
    fn update(&mut self, data: &[u8]);

    /// Consume the state and return the digest bytes.
    fn finalize_boxed(self: Box<Self>) -> Vec<u8>;
}

/// Create streaming hash states for a named digest algorithm.
pub trait StreamingHasher {
    type Error: std::error::Error + Send + Sync + 'static;

    /// Begin a new incremental hash computation for `algorithm`
    /// (e.g. `"sha256"`, `"sha384"`, `"sha512"`).
    ///
    /// Returns a heap-allocated [`HashState`] that accepts further data via
    /// [`HashState::update`] and produces the digest via
    /// [`HashState::finalize_boxed`].
    fn new_hash(&self, algorithm: &str) -> Result<Box<dyn HashState>, Self::Error>;
}

// ── ErasedStreamingHasher ─────────────────────────────────────────────────────

/// Object-safe [`StreamingHasher`] variant with a type-erased error.
///
/// Used as the return type of [`default_streaming_hasher`] so that callers
/// receive a `Box<dyn ErasedStreamingHasher>` without naming the backend type.
/// The boxed value implements [`StreamingHasher`] directly via the blanket impl
/// below.
///
/// [`default_streaming_hasher`]: crate::default_streaming_hasher
pub trait ErasedStreamingHasher {
    /// Begin a new streaming hash; returns [`PrivateKeyError`] on failure.
    fn new_hash_erased(&self, algorithm: &str) -> Result<Box<dyn HashState>, PrivateKeyError>;
}

/// Blanket impl: `&dyn ErasedStreamingHasher` implements [`StreamingHasher`].
impl StreamingHasher for dyn ErasedStreamingHasher + '_ {
    type Error = PrivateKeyError;

    fn new_hash(&self, algorithm: &str) -> Result<Box<dyn HashState>, PrivateKeyError> {
        self.new_hash_erased(algorithm)
    }
}

/// Blanket impl: `Box<dyn ErasedStreamingHasher>` implements [`StreamingHasher`].
///
/// Allows the value returned by [`default_streaming_hasher`] to be used
/// directly wherever `impl StreamingHasher` is accepted.
///
/// [`default_streaming_hasher`]: crate::default_streaming_hasher
impl StreamingHasher for Box<dyn ErasedStreamingHasher> {
    type Error = PrivateKeyError;

    fn new_hash(&self, algorithm: &str) -> Result<Box<dyn HashState>, PrivateKeyError> {
        self.as_ref().new_hash_erased(algorithm)
    }
}

// ── ErasedDataHasher ──────────────────────────────────────────────────────────

/// Object-safe [`DataHasher`] variant with a type-erased error.
///
/// Used as the return type of [`default_data_hasher`] so that callers receive a
/// `Box<dyn ErasedDataHasher>` without naming the backend type.  The boxed value
/// implements [`DataHasher`] directly via the blanket impls below, so it can be
/// passed to any function that accepts `impl DataHasher` or `&dyn DataHasher`.
///
/// [`default_data_hasher`]: crate::default_data_hasher
pub trait ErasedDataHasher {
    /// Hash `data` with the named `algorithm` (e.g. `"sha256"`);
    /// returns [`PrivateKeyError`] on failure.
    fn hash_data_erased(&self, algorithm: &str, data: &[u8]) -> Result<Vec<u8>, PrivateKeyError>;
}

/// Blanket impl: `&dyn ErasedDataHasher` implements [`DataHasher`].
impl DataHasher for dyn ErasedDataHasher + '_ {
    type Error = PrivateKeyError;

    fn hash_data(&self, algorithm: &str, data: &[u8]) -> Result<Vec<u8>, PrivateKeyError> {
        self.hash_data_erased(algorithm, data)
    }
}

/// Blanket impl: `Box<dyn ErasedDataHasher>` implements [`DataHasher`].
///
/// Allows the value returned by [`default_data_hasher`] to be used directly
/// wherever `impl DataHasher` is accepted, without calling `.as_ref()`.
///
/// [`default_data_hasher`]: crate::default_data_hasher
impl DataHasher for Box<dyn ErasedDataHasher> {
    type Error = PrivateKeyError;

    fn hash_data(&self, algorithm: &str, data: &[u8]) -> Result<Vec<u8>, PrivateKeyError> {
        self.as_ref().hash_data_erased(algorithm, data)
    }
}

// ── ErasedHmacProvider ────────────────────────────────────────────────────────

/// Object-safe [`HmacProvider`] variant with a type-erased error.
///
/// Used as the return type of [`default_hmac_provider`] so that callers receive
/// a `Box<dyn ErasedHmacProvider>` without naming the backend type.  The boxed
/// value implements [`HmacProvider`] directly via the blanket impls below.
///
/// [`default_hmac_provider`]: crate::default_hmac_provider
pub trait ErasedHmacProvider {
    /// Compute HMAC of `data` under `key` with the named `algorithm`;
    /// returns [`PrivateKeyError`] on failure.
    fn hmac_compute_erased(
        &self,
        algorithm: &str,
        key: &[u8],
        data: &[u8],
    ) -> Result<Vec<u8>, PrivateKeyError>;

    /// Verify that HMAC of `data` under `key` equals `expected` in constant
    /// time; returns [`PrivateKeyError`] on mismatch or backend error.
    fn hmac_verify_erased(
        &self,
        algorithm: &str,
        key: &[u8],
        data: &[u8],
        expected: &[u8],
    ) -> Result<(), PrivateKeyError>;
}

/// Blanket impl: `&dyn ErasedHmacProvider` implements [`HmacProvider`].
impl HmacProvider for dyn ErasedHmacProvider + '_ {
    type Error = PrivateKeyError;

    fn hmac_compute(
        &self,
        algorithm: &str,
        key: &[u8],
        data: &[u8],
    ) -> Result<Vec<u8>, PrivateKeyError> {
        self.hmac_compute_erased(algorithm, key, data)
    }

    fn hmac_verify(
        &self,
        algorithm: &str,
        key: &[u8],
        data: &[u8],
        expected: &[u8],
    ) -> Result<(), PrivateKeyError> {
        self.hmac_verify_erased(algorithm, key, data, expected)
    }
}

/// Blanket impl: `Box<dyn ErasedHmacProvider>` implements [`HmacProvider`].
///
/// Allows the value returned by [`default_hmac_provider`] to be used directly
/// wherever `impl HmacProvider` is accepted, without calling `.as_ref()`.
///
/// [`default_hmac_provider`]: crate::default_hmac_provider
impl HmacProvider for Box<dyn ErasedHmacProvider> {
    type Error = PrivateKeyError;

    fn hmac_compute(
        &self,
        algorithm: &str,
        key: &[u8],
        data: &[u8],
    ) -> Result<Vec<u8>, PrivateKeyError> {
        self.as_ref().hmac_compute_erased(algorithm, key, data)
    }

    fn hmac_verify(
        &self,
        algorithm: &str,
        key: &[u8],
        data: &[u8],
        expected: &[u8],
    ) -> Result<(), PrivateKeyError> {
        self.as_ref()
            .hmac_verify_erased(algorithm, key, data, expected)
    }
}

// ── No-op sentinel ────────────────────────────────────────────────────────────

/// No-op symmetric crypto implementation when no backend is compiled in.
pub struct NoSymmetricCrypto;

impl DataHasher for NoSymmetricCrypto {
    type Error = NoCryptoError;
    fn hash_data(&self, _: &str, _: &[u8]) -> Result<Vec<u8>, NoCryptoError> {
        Err(NoCryptoError)
    }
}

impl HmacProvider for NoSymmetricCrypto {
    type Error = NoCryptoError;
    fn hmac_compute(&self, _: &str, _: &[u8], _: &[u8]) -> Result<Vec<u8>, NoCryptoError> {
        Err(NoCryptoError)
    }
    fn hmac_verify(&self, _: &str, _: &[u8], _: &[u8], _: &[u8]) -> Result<(), NoCryptoError> {
        Err(NoCryptoError)
    }
}

impl Pbkdf2Provider for NoSymmetricCrypto {
    type Error = NoCryptoError;
    fn pbkdf2_hmac(
        &self,
        _: &str,
        _: &[u8],
        _: &[u8],
        _: usize,
        _: usize,
    ) -> Result<Vec<u8>, NoCryptoError> {
        Err(NoCryptoError)
    }
}

impl BlockCipherProvider for NoSymmetricCrypto {
    type Error = NoCryptoError;
    fn aes_cbc_encrypt(
        &self,
        _: &[u8],
        _: &[u8],
        _: &[u8],
        _: bool,
    ) -> Result<Vec<u8>, NoCryptoError> {
        Err(NoCryptoError)
    }
    fn aes_cbc_decrypt(
        &self,
        _: &[u8],
        _: &[u8],
        _: &[u8],
        _: bool,
    ) -> Result<Vec<u8>, NoCryptoError> {
        Err(NoCryptoError)
    }
    fn des3_cbc_encrypt(
        &self,
        _: &[u8],
        _: &[u8],
        _: &[u8],
        _: bool,
    ) -> Result<Vec<u8>, NoCryptoError> {
        Err(NoCryptoError)
    }
    fn des3_cbc_decrypt(
        &self,
        _: &[u8],
        _: &[u8],
        _: &[u8],
        _: bool,
    ) -> Result<Vec<u8>, NoCryptoError> {
        Err(NoCryptoError)
    }
    fn aes_gcm_encrypt(
        &self,
        _: &[u8],
        _: &[u8],
        _: &[u8],
        _: &[u8],
    ) -> Result<Vec<u8>, NoCryptoError> {
        Err(NoCryptoError)
    }
    fn aes_gcm_decrypt(
        &self,
        _: &[u8],
        _: &[u8],
        _: &[u8],
        _: &[u8],
    ) -> Result<Vec<u8>, NoCryptoError> {
        Err(NoCryptoError)
    }
}

impl SecureRandom for NoSymmetricCrypto {
    type Error = NoCryptoError;
    fn rand_bytes(&self, _: &mut [u8]) -> Result<(), NoCryptoError> {
        Err(NoCryptoError)
    }
}

impl ErasedDataHasher for NoSymmetricCrypto {
    fn hash_data_erased(&self, _: &str, _: &[u8]) -> Result<Vec<u8>, PrivateKeyError> {
        Err(PrivateKeyError::new(NoCryptoError))
    }
}

impl ErasedStreamingHasher for NoSymmetricCrypto {
    fn new_hash_erased(&self, _: &str) -> Result<Box<dyn HashState>, PrivateKeyError> {
        Err(PrivateKeyError::new(NoCryptoError))
    }
}

impl ErasedHmacProvider for NoSymmetricCrypto {
    fn hmac_compute_erased(&self, _: &str, _: &[u8], _: &[u8]) -> Result<Vec<u8>, PrivateKeyError> {
        Err(PrivateKeyError::new(NoCryptoError))
    }

    fn hmac_verify_erased(
        &self,
        _: &str,
        _: &[u8],
        _: &[u8],
        _: &[u8],
    ) -> Result<(), PrivateKeyError> {
        Err(PrivateKeyError::new(NoCryptoError))
    }
}

impl ErasedStreamingHmacProvider for NoSymmetricCrypto {
    fn new_hmac_erased(&self, _: &str, _: &[u8]) -> Result<Box<dyn HmacState>, PrivateKeyError> {
        Err(PrivateKeyError::new(NoCryptoError))
    }
}

// ── HmacState ─────────────────────────────────────────────────────────────────

/// A live streaming HMAC computation.
///
/// Created by [`StreamingHmacProvider::new_hmac`]; data is fed in with
/// [`update`]; the final MAC is produced by [`finalize_boxed`].
///
/// `finalize_boxed` takes `Box<Self>` rather than `self` so that the trait is
/// object-safe and the state can be stored behind `Box<dyn HmacState>`.
///
/// [`update`]: HmacState::update
/// [`finalize_boxed`]: HmacState::finalize_boxed
pub trait HmacState: Send {
    /// Feed `data` into the running HMAC computation.
    fn update(&mut self, data: &[u8]);

    /// Consume the state and return the MAC bytes.
    fn finalize_boxed(self: Box<Self>) -> Vec<u8>;
}

// ── StreamingHmacProvider ─────────────────────────────────────────────────────

/// Create streaming HMAC states for a named digest algorithm.
///
/// Unlike the one-shot [`HmacProvider::hmac_compute`], this trait lets callers
/// feed data incrementally — useful for large messages or when the input is
/// produced in chunks.
pub trait StreamingHmacProvider {
    type Error: std::error::Error + Send + Sync + 'static;

    /// Begin a new incremental HMAC computation for `algorithm`
    /// (e.g. `"sha256"`, `"sha384"`, `"sha512"`) keyed with `key`.
    ///
    /// Returns a heap-allocated [`HmacState`] that accepts further data via
    /// [`HmacState::update`] and produces the MAC via
    /// [`HmacState::finalize_boxed`].
    fn new_hmac(&self, algorithm: &str, key: &[u8]) -> Result<Box<dyn HmacState>, Self::Error>;
}

// ── ErasedStreamingHmacProvider ───────────────────────────────────────────────

/// Object-safe [`StreamingHmacProvider`] variant with a type-erased error.
///
/// Used as the return type of [`default_streaming_hmac_provider`] so that
/// callers receive a `Box<dyn ErasedStreamingHmacProvider>` without naming
/// the backend type.  The boxed value implements [`StreamingHmacProvider`]
/// directly via the blanket impl below.
///
/// [`default_streaming_hmac_provider`]: crate::default_streaming_hmac_provider
pub trait ErasedStreamingHmacProvider {
    /// Begin a new streaming HMAC; returns [`PrivateKeyError`] on failure.
    fn new_hmac_erased(
        &self,
        algorithm: &str,
        key: &[u8],
    ) -> Result<Box<dyn HmacState>, PrivateKeyError>;
}

/// Blanket impl: `&dyn ErasedStreamingHmacProvider` implements
/// [`StreamingHmacProvider`].
impl StreamingHmacProvider for dyn ErasedStreamingHmacProvider + '_ {
    type Error = PrivateKeyError;

    fn new_hmac(&self, algorithm: &str, key: &[u8]) -> Result<Box<dyn HmacState>, PrivateKeyError> {
        self.new_hmac_erased(algorithm, key)
    }
}

/// Blanket impl: `Box<dyn ErasedStreamingHmacProvider>` implements
/// [`StreamingHmacProvider`].
///
/// Allows the value returned by [`default_streaming_hmac_provider`] to be
/// used directly wherever `impl StreamingHmacProvider` is accepted.
///
/// [`default_streaming_hmac_provider`]: crate::default_streaming_hmac_provider
impl StreamingHmacProvider for Box<dyn ErasedStreamingHmacProvider> {
    type Error = PrivateKeyError;

    fn new_hmac(&self, algorithm: &str, key: &[u8]) -> Result<Box<dyn HmacState>, PrivateKeyError> {
        self.as_ref().new_hmac_erased(algorithm, key)
    }
}

// ── HKDF (RFC 5869) ───────────────────────────────────────────────────────────

/// HKDF-Extract (RFC 5869 §2.2).
///
/// Computes `PRK = HMAC-Hash(salt, IKM)` where `salt` defaults to a string
/// of `HashLen` zero bytes when `None`.  The returned pseudorandom key (PRK)
/// can be passed directly to [`hkdf_expand`].
///
/// # Arguments
///
/// * `hmac`      — any [`HmacProvider`] (use [`crate::default_hmac_provider`]
///   for the compiled-in backend).
/// * `algorithm` — hash name: `"sha256"`, `"sha384"`, `"sha512"`, etc.
/// * `salt`      — optional salt; `None` uses `HashLen` zero bytes.
/// * `ikm`       — input keying material.
///
/// # Errors
///
/// Returns the backend's error type if `algorithm` is unknown or the HMAC
/// computation fails.
pub fn hkdf_extract<P>(
    hmac: &P,
    algorithm: &str,
    salt: Option<&[u8]>,
    ikm: &[u8],
) -> Result<Vec<u8>, P::Error>
where
    P: HmacProvider,
{
    let hash_len = hmac_output_len(algorithm).unwrap_or(32);
    let default_salt: Vec<u8>;
    let effective_salt = match salt {
        Some(s) => s,
        None => {
            default_salt = vec![0u8; hash_len];
            &default_salt
        }
    };
    hmac.hmac_compute(algorithm, effective_salt, ikm)
}

/// HKDF-Expand (RFC 5869 §2.3).
///
/// Expands a pseudorandom key `prk` (from [`hkdf_extract`]) into `length`
/// bytes of output keying material (OKM) using `info` as a context label.
///
/// # Arguments
///
/// * `hmac`      — any [`HmacProvider`].
/// * `algorithm` — hash name: `"sha256"`, `"sha384"`, `"sha512"`, etc.
/// * `prk`       — pseudorandom key (output of HKDF-Extract or a strong key).
/// * `info`      — context and application-specific information (may be empty).
/// * `length`    — desired output length in bytes (≤ 255 × HashLen).
///
/// # Errors
///
/// Returns the backend's error type if `algorithm` is unknown, `length` is
/// too large (> 255 × HashLen), or the HMAC computation fails.
pub fn hkdf_expand<P>(
    hmac: &P,
    algorithm: &str,
    prk: &[u8],
    info: &[u8],
    length: usize,
) -> Result<Vec<u8>, P::Error>
where
    P: HmacProvider,
{
    if length == 0 {
        return Ok(Vec::new());
    }
    let hash_len = hmac_output_len(algorithm).unwrap_or(32);
    // Compute blocks needed (RFC 5869: N = ceil(L / HashLen), N ≤ 255)
    let n = length.div_ceil(hash_len);
    debug_assert!(n <= 255, "hkdf_expand: length too large for algorithm");

    let mut okm = Vec::with_capacity(length);
    let mut t: Vec<u8> = Vec::new(); // T(0) = empty string
    for i in 1u8..=(n as u8) {
        // T(i) = HMAC-Hash(PRK, T(i-1) || info || i)
        let mut input = Vec::with_capacity(t.len() + info.len() + 1);
        input.extend_from_slice(&t);
        input.extend_from_slice(info);
        input.push(i);
        t = hmac.hmac_compute(algorithm, prk, &input)?;
        okm.extend_from_slice(&t);
    }
    okm.truncate(length);
    Ok(okm)
}