Skip to main content

derive_key_32

phantom_protocol::crypto::kdf

Function derive_key_32 

Source 
pub fn derive_key_32(label: &str, ikm: &[u8]) -> [u8; 32]
Expand description

32-byte key derivation that matches blake3::derive_key’s API shape (label string + IKM bytes → [u8; 32]) and dispatches per the active build:

  • Default: blake3::derive_key(label, ikm) — pure-Rust, infallible.
  • --features fips: HKDF-SHA256 with empty salt, info = label bytes. FIPS 140-3 §C-approved (SP 800-108) so the same call-sites stay valid under the fips swap.

PANIC-SAFETY: HKDF-SHA256 expand only errors when the requested output length exceeds 255 * HashLen (255 * 32 = 8160 bytes for SHA-256). 32 bytes is well within that ceiling, so the expect_used is statically safe.