Module kdf 

Shared key-derivation helpers (Phase 4.1).

Functions here are deterministic and side-agnostic: the client and the server feed identical inputs and obtain identical outputs. They live in crypto/ rather than transport/ so both the server handshake path (transport::handshake) and the client API path (api::session) can call them without a circular module dependency.

Functions

derive_early_data_keying

Derive the AEAD (key, nonce) pair that protects 0-RTT early-data carried inside a V3 ClientHello.

derive_key_32

32-byte key derivation that matches blake3::derive_key’s API shape (label string + IKM bytes → [u8; 32]) and dispatches per the active build: