hkdf_sha1.nx

hkdf_sha1.nx -- HMAC-based Key Derivation Function with SHA-1. RFC 5869 HKDF, SHA-1 variant. Less common today than the SHA-256 variant (hkdf.nx) but still on the wire in: - Signal Protocol interop with older clients - Some TLS 1.2 PRF variants - Legacy WPA3 Dragonfly (SAE) key schedule HKDF in two phases: PRK = HMAC(salt, IKM) (extract) T(0) = \"\" T(i) = HMAC(PRK, T(i-1) || info || i) (expand) OKM = T(1) || T(2) || ... truncated to L The expand phase counter is a single byte (range 1..255), so max output is 255 * 20 = 5100 bytes. For larger keys (rare) composers must re-run with a different info string. Composes hmac_sha1.nx. Invariants: H1 If salt is empty, RFC 5869 says use a zero-filled HashLen (20 zeros). We implement that default. H2 Output length capped at 255 * 20 = 5100 bytes; beyond that we truncate silently. Callers requesting more should raise it in info/DOM-specific mode.