2 files changed, 62 insertions, 0 deletions
diff --git a/src/tests/data/hkdf_label.vec b/src/tests/data/hkdf_label.vec
new file mode 100644
index 000000000..925b96869
--- /dev/null
+++ b/src/tests/data/hkdf_label.vec
@@ -0,0 +1,24 @@
+[SHA-256]
+
+# Generated by the Go version in BoringSSL
+
+Secret = fb8e20fc2e4c3f248c60c39bd652f3c1347298bb977b8b4d5903b85055620603
+Label = TLS 1.3, something or other
+HashValue = e5007b1522d10013a1a7a32b3a6f82df1861074ba3d592abc9656cef425d1e9a
+Output = 531c0f2906532ece3c7c352b73885a87558d6b2f
+
+Secret = 4e26e6cc23cff7773690e838ed16648b4143d200b5835e6f38525055e0f71cb2
+Label = TLS 1.3, something or other
+HashValue = 16ff13612414de6dd55a976d355418756129a69eeaf116b807f6dd
+Output = 1f55b71137985032969620eb7f598694ae16f490
+
+[SHA-384]
+Secret = 7fff5f3d5a1637d91e5e27290b6a0f95d3be48f29a82433dae0e4db1a77176b19143076fc35f0217a16939ea6a8dfe7c
+Label = TLS 1.3, something or other
+HashValue = 55acb630845700a42a5e5d41dd2f7816b5599d949ed86674eb26644b594bc34443f1cd095d168377cabb7b
+Output = 831a9592e0349f7abba2dff78af07418d489f353
+
+Secret = 47115775423d78074b1a1e605a941836f462a17c865c4e97efe3355a445710087af4010ed1f570e34a7f31aca3b060e7d2d27bf5dc902327b90d05
+Label = TLS 1.3, now that's what I call a label!
+HashValue = ff4351c0de4ca54560d26cb5bdd4048fed3853297ebb516b284ccfd5e081ce5c0719965323f65914516669
+Output = e4b8ca51ee3567db6fe6fd5e656568140dbee604abe9e9e92a24e885c313a070
diff --git a/src/tests/test_kdf.cpp b/src/tests/test_kdf.cpp
index 1e5152ba5..6bc910d2a 100644
--- a/src/tests/test_kdf.cpp
+++ b/src/tests/test_kdf.cpp
@@ -10,6 +10,10 @@
    #include <botan/kdf.h>
 #endif
 
+#if defined(BOTAN_HAS_HKDF)
+   #include <botan/hkdf.h>
+#endif
+
 namespace Botan_Tests {
 
 namespace {
@@ -54,6 +58,40 @@ BOTAN_REGISTER_TEST("kdf", KDF_KAT_Tests);
 
 #endif
 
+#if defined(BOTAN_HAS_HKDF)
+class HKDF_Expand_Label_Tests final : public Text_Based_Test
+   {
+   public:
+      HKDF_Expand_Label_Tests() :
+         Text_Based_Test("hkdf_label.vec", "Secret,Label,HashValue,Output") {}
+
+      Test::Result run_one_test(const std::string& hash_name, const VarMap& vars) override
+         {
+         Test::Result result("HKDF-Expand-Label(" + hash_name + ")");
+
+         const std::vector<uint8_t> secret = get_req_bin(vars, "Secret");
+         const std::vector<uint8_t> hashval = get_req_bin(vars, "HashValue");
+         const std::string label = get_req_str(vars, "Label");
+         const std::vector<uint8_t> expected = get_req_bin(vars, "Output");
+
+         Botan::secure_vector<uint8_t> output =
+            Botan::hkdf_expand_label(hash_name,
+                                     secret.data(), secret.size(),
+                                     label,
+                                     hashval.data(), hashval.size(),
+                                     expected.size());
+
+         result.test_eq("Output matches", output, expected);
+
+         return result;
+         }
+
+   };
+
+BOTAN_REGISTER_TEST("hkdf_expand_label", HKDF_Expand_Label_Tests);
+
+#endif
+
 }
 
 }