Add hashAlgorithm to IKE-PRF (#873)

stevespringett · web-flow · commit bbc87f791f2c · 2026-03-26T09:44:41.000-05:00
fixes #872 Also changes primitive to "kdf" since this is a KDF, not a key agreement function.
diff --git a/schema/cryptography-defs.json b/schema/cryptography-defs.json
@@ -801,16 +801,16 @@
       ],
       "variant": [
         {
-          "pattern": "IKE_PRF_DERIVE",
-          "primitive": "key-agree"
+          "pattern": "IKE_PRF_DERIVE[-{hashAlgorithm}]",
+          "primitive": "kdf"
         },
         {
-          "pattern": "IKE1_(PRF|Extended)_DERIVE",
-          "primitive": "key-agree"
+          "pattern": "IKE1_(PRF|Extended)_DERIVE[-{hashAlgorithm}]",
+          "primitive": "kdf"
         },
         {
-          "pattern": "IKE2_PRF_PLUS_DERIVE",
-          "primitive": "key-agree"
+          "pattern": "IKE2_PRF_PLUS_DERIVE[-{hashAlgorithm}]",
+          "primitive": "kdf"
         }
       ]
     },

Original file line number	Diff line number	Diff line change
`@@ -801,16 +801,16 @@`
`801`	`801`	`],`
`802`	`802`	`"variant": [`
`803`	`803`	`{`
`804`		`- "pattern": "IKE_PRF_DERIVE",`
`805`		`- "primitive": "key-agree"`
	`804`	`+ "pattern": "IKE_PRF_DERIVE[-{hashAlgorithm}]",`
	`805`	`+ "primitive": "kdf"`
`806`	`806`	`},`
`807`	`807`	`{`
`808`		`- "pattern": "IKE1_(PRF\|Extended)_DERIVE",`
`809`		`- "primitive": "key-agree"`
	`808`	`+ "pattern": "IKE1_(PRF\|Extended)_DERIVE[-{hashAlgorithm}]",`
	`809`	`+ "primitive": "kdf"`
`810`	`810`	`},`
`811`	`811`	`{`
`812`		`- "pattern": "IKE2_PRF_PLUS_DERIVE",`
`813`		`- "primitive": "key-agree"`
	`812`	`+ "pattern": "IKE2_PRF_PLUS_DERIVE[-{hashAlgorithm}]",`
	`813`	`+ "primitive": "kdf"`
`814`	`814`	`}`
`815`	`815`	`]`
`816`	`816`	`},`