[Cfrg] Implementing draft-cfrg-randomness-improvements

[Kris Kwiatkowski <[e-mail]>]

Hi,

I've implemented PoC of draft-cfrg-randomness-improvements-07 with a goal of
assessing potential
costs of both - performance and integration.

The implementation (PoC) is integrated into BoringSSL (as default random
generator) and it comes
with small bench application for TLS testing.

Performance results and implementation details can be found here:
* https://github.com/henrydcase/PoC-draft-cfrg-randomness-improvements/

While interpreting results, one of the draft authors informed that there may
be a bug in
the draft. Namely, draft currently specifies that amount of randomness that
randomness wrapper
is requesting from CSPRNG is equal to "L", where L is fixed for any
instantiation of randomness
wrapper and equal to output byte size of HKDF-Extract.

1. Can it be confirmed that this is wrong and will be changed in future
release of the draft?
2. Also, is there any limit for "n" - amount of randomness that can be
requested from
   randomness wrapper?
   It was briefly mentioned to me that limit is L+M (where M is output size of
hash function H).
   Nevertheless, I can't say I fully understand this choice.

---
Kind regards,
Kris