output key length is fixed. // // It's optimized for use in XAES-256-GCM (https://c2sp.org/XAES-256-GCM), // rather than for exposing it to applications as a stand-alone KDF. type CounterKDF struct { mac CMAC } // NewCounterKDF creates a new CounterKDF with the given key. func NewCounterKDF(b *aes.Block) *CounterKDF { return &CounterKDF{mac: *NewCMAC(b)} } // DeriveKey derives a key from the given label and context. func (kdf *CounterKDF) DeriveKey(label byte, context [12]byte) [32]byte { fips140.RecordApproved()...