derive
Derive a deterministic key from input material using HKDF (RFC 5869) with HMAC-SHA256.
Used for reproducible derivations (e.g., idempotency keys) where the same IKM, salt, and context must always yield the same output. HKDF is the correct primitive for this: PBKDF2 is designed for password stretching and routing raw bytes through a char-based PBEKeySpec is lossy across provider implementations.
Output length matches KeyDerivationConfig.keyLengthBits (must be a multiple of 8).
Return
The derived bytes, length keyLengthBits / 8.
Parameters
input
Input keying material (IKM).
context
Context / info parameter for domain separation.
salt
HKDF salt; public, should be non-empty for best PRK quality.