Constant EXPAND_FIXED_COST

pub const EXPAND_FIXED_COST: u64 = _; // 120u64
Expand description

For HKDF, we do:

  1. EXTRACT → HMAC-SHA256( salt, input ) with variable-sized input. TODO: If no salt, is that only one run SHA-256?
  2. EXPAND → HMAC-SHA256( PRK, info ) with a short, fixed-length info.

We’ll treat Expand as another HMAC with small input => we approximate with a constant cost derived from HMAC-SHA256 on a ~64-byte buffer, i.e. ~2 * single SHA-256 base.