Create individual crypto callbacks for hkdf extract and hkdf expand

[twcook86]

Description

Fixes zd#21919

Testing

built-in test.c expanded

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[Copilot]

Pull request overview

This PR refines the crypto-callback (WOLF_CRYPTO_CB) KDF interface by splitting HKDF into distinct callback operations for HKDF-Extract and HKDF-Expand, and updates library internals and tests accordingly.

Changes:

• Introduces new KDF callback types and wc_CryptoInfo payloads for HKDF extract/expand.
• Adds new internal crypto-callback dispatch helpers (wc_CryptoCb_Hkdf_Extract / wc_CryptoCb_Hkdf_Expand) and wires them into HKDF code paths.
• Expands HKDF tests to exercise extract+expand flows in addition to one-shot HKDF.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
wolfssl/wolfcrypt/types.h	Adds new wc_KdfType values for HKDF extract/expand.
wolfssl/wolfcrypt/cryptocb.h	Extends wc_CryptoInfo KDF union with HKDF extract/expand structs and declares new callback helpers.
wolfcrypt/src/hmac.c	Routes HKDF Extract/Expand through crypto callbacks when available.
wolfcrypt/src/cryptocb.c	Implements new crypto-callback helper functions and updates debug strings for KDF type.
wolfcrypt/test/test.c	Adds HKDF extract/expand test coverage and updates test crypto-device callback handling.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[bigbrett]

Would prefer you append-only to public structs, but its fine as is since it is only used by CryptoCbs and those aren't ABI restricted

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #10598

Scan targets checked: wolfcrypt-bugs, wolfcrypt-port-bugs, wolfcrypt-rs-bugs, wolfcrypt-src, wolfssl-bugs, wolfssl-src

Findings: 3
3 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

[github-actions]

MemBrowse Memory Report

gcc-arm-cortex-m0plus

• FLASH: .text +312 B (+0.5%, 63,475 B / 262,144 B, total: 24% used)

gcc-arm-cortex-m3

• FLASH: .text +684 B (+0.6%, 121,257 B / 262,144 B, total: 46% used)

gcc-arm-cortex-m4

• FLASH: .text +768 B (+0.4%, 198,702 B / 262,144 B, total: 76% used)

gcc-arm-cortex-m4-baremetal

• FLASH: .text +320 B (+0.5%, 66,059 B / 262,144 B, total: 25% used)

gcc-arm-cortex-m4-crypto-only

• FLASH: .text +512 B (+0.3%, 173,550 B / 262,144 B, total: 66% used)

gcc-arm-cortex-m4-dtls13

• FLASH: .text +1,024 B (+0.6%, 179,608 B / 1,048,576 B, total: 17% used)

gcc-arm-cortex-m4-min-ecc

• FLASH: .text +320 B (+0.5%, 61,037 B / 262,144 B, total: 23% used)

gcc-arm-cortex-m4-openssl-compat

• FLASH: .rodata +24 B, .text +1,920 B (+0.3%, 766,252 B / 1,048,576 B, total: 73% used)

gcc-arm-cortex-m4-pkcs7

• FLASH: .text +576 B (+0.3%, 210,993 B / 262,144 B, total: 80% used)

gcc-arm-cortex-m4-pq

• FLASH: .text +1,088 B (+0.4%, 277,208 B / 1,048,576 B, total: 26% used)

gcc-arm-cortex-m4-rsa-only

• FLASH: .text +1,024 B (+0.3%, 322,616 B / 1,048,576 B, total: 31% used)

gcc-arm-cortex-m4-sp-math

• FLASH: .text +320 B (+0.5%, 61,037 B / 262,144 B, total: 23% used)

gcc-arm-cortex-m4-tls12

• FLASH: .text +704 B (+0.6%, 121,997 B / 262,144 B, total: 47% used)

gcc-arm-cortex-m4-tls13

• FLASH: .text +1,024 B (+0.4%, 234,464 B / 262,144 B, total: 89% used)

gcc-arm-cortex-m7

• FLASH: .text +768 B (+0.4%, 198,702 B / 262,144 B, total: 76% used)

gcc-arm-cortex-m7-pq

• FLASH: .text +1,088 B (+0.4%, 277,784 B / 1,048,576 B, total: 26% used)

gcc-arm-cortex-m7-tls13

• FLASH: .text +1,024 B (+0.4%, 234,464 B / 262,144 B, total: 89% used)

linuxkm-pie

• Data: __patchable_function_entries +32 B (+0.1%, 24,208 B)

linuxkm-standard

• Data: __patchable_function_entries +40 B (+0.1%, 45,920 B)

stm32-sim-stm32h753

• FLASH: .text +64 B (+0.0%, 181,492 B / 2,097,152 B, total: 9% used)

[billphipps]

Please move the check for cryptocb into the hdkf functions, not in the side that is using it. Check on unit testing the interface as well. Looks like a great start!

[ColtonWilley]

Jenkins retest this please

[billphipps]

LGTM! Thank you!

[dgarske]

Skoll Code Review

Scan type: reviewOverall recommendation: COMMENT
Findings: 3 total — 2 posted, 1 skipped
2 finding(s) posted as inline comments (see file-level comments below)

Posted findings

• [Low] New inKey/out NULL validation in wc_HKDF_Expand_ex lacks a negative test — wolfcrypt/test/test.c:34951-34962
• [Info] Misaligned indentation in new Extract callback block — wolfcrypt/src/hmac.c:1764

Skipped findings

• [Medium] Existing KDF crypto-cb devices now receive new HKDF_EXTRACT/HKDF_EXPAND callbacks

Review generated by Skoll

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.