Basic KDF functions

src/enacl.erl

@@ -125,6 +125,13 @@
 
 ]).
 
+%% Key derivation
+-export([
+         kdf_KEYBYTES/0,
+         kdf_CONTEXTBYTES/0,
+         kdf_derive_from_key/3
+]).
+
 %% Low-level subtle functions which are hard to get correct
 -export([
          %% EQC
@@ -456,6 +463,29 @@ null_terminate(ASCII) ->
 pwhash_str_verify(HashPassword, Password) ->
     enacl_nif:crypto_pwhash_str_verify(null_terminate(HashPassword), Password).
 
+%% Key Derivation
+%% @doc kdf_KEYBYTES/0 returns the number of bytes required for master key.
+%% @end
+-spec kdf_KEYBYTES() -> pos_integer().
+kdf_KEYBYTES() ->
+    enacl_nif:crypto_kdf_KEYBYTES().
+
+%% @doc kdf_CONTEXTBYTES/0 returns the number of bytes required for context.
+%% @end
+-spec kdf_CONTEXTBYTES() -> pos_integer().
+kdf_CONTEXTBYTES() ->
+    enacl_nif:crypto_kdf_CONTEXTBYTES().
+
+%% @doc kdf_derive_from_key/3 derive a key from a single high entropy key
+%% @end.
+-spec kdf_derive_from_key(MasterKey, Context, Id) -> binary()
+    when
+      MasterKey :: iodata(),
+      Context   :: binary(),
+      Id        :: pos_integer().
+kdf_derive_from_key(MasterKey, Context, Id) ->
+    enacl_nif:crypto_kdf_derive_from_key(MasterKey, Context, Id).
+
 %% Public Key Crypto
 %% ---------------------
 %% @doc box_keypair/0 creates a new Public/Secret keypair.

src/enacl_nif.erl

@@ -152,6 +152,13 @@
          crypto_pwhash_str_verify/2
         ]).
 
+%% Key Derivation
+-export([
+         crypto_kdf_KEYBYTES/0,
+         crypto_kdf_CONTEXTBYTES/0,
+         crypto_kdf_derive_from_key/3
+        ]).
+
 %% Generic hash
 -export([
          crypto_generichash_BYTES/0,
@@ -242,6 +249,10 @@ crypto_pwhash(_Password, _Salt, _Ops, _Mem) -> erlang:nif_error(nif_not_loaded).
 crypto_pwhash_str(_Password, _Ops, _Mem) -> erlang:nif_error(nif_not_loaded).
 crypto_pwhash_str_verify(_HashedPassword, _Password) -> erlang:nif_error(nif_not_loaded).
 
+crypto_kdf_KEYBYTES() -> erlang:nif_error(nif_not_loaded).
+crypto_kdf_CONTEXTBYTES() -> erlang:nif_error(nif_not_loaded).
+crypto_kdf_derive_from_key(_MasterKey, _Context, _Id) -> erlang:nif_error(nif_not_loaded).
+
 crypto_box_NONCEBYTES() -> erlang:nif_error(nif_not_loaded).
 crypto_box_ZEROBYTES() -> erlang:nif_error(nif_not_loaded).
 crypto_box_BOXZEROBYTES() -> erlang:nif_error(nif_not_loaded).