nx_tls13_kdf_test.nx

nx_tls13_kdf_test.nx -- RFC 8446 §7.1 + RFC 8448 §3 KAT for the TLS 1.3 HKDF-Expand-Label + Derive-Secret wrappers. Three verification steps: A. HkdfLabel byte construction for the canonical first-call ("derived" label, empty-message SHA-256 hash as context, length 32). Verifies the structure layout exactly matches RFC 8446 §7.1's `struct HkdfLabel`. B. RFC 8448 §3 early_secret = HKDF-Extract(salt=0, IKM=0^32) = 33ad0a1c607ec03b09e6cd9893680ce210adf300aa1f2660e1b22e10f170f92a (the first secret in TLS 1.3's 5-stage key schedule, in the no-PSK case which is what 99% of fresh TLS handshakes use). C. RFC 8448 §3 derived = Derive-Secret(early_secret, "derived", empty) = 6f2615a108c702c5678f54fc9dbab69716c076189c48250cebeac3576c3611ba (the secret that gets HKDF-Extract'd with ECDHE output to produce the handshake_secret). The empty SHA-256 hash is hardcoded as the well-known constant e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 to keep this test focused on the KDF logic (the SHA-256 module has its own KAT). expect_exit: 0 license_tier: ORIGINAL