KDA Two Step SP800-56CR2 Counter Length Options Seem to Require 0

[AlexThurston]

When registering the algorithm in the title, it appears at though if Fixed Data Order includes none, then the counter length of 0 must also be provided based on the error that is returned from ACVP. However, the documentation for the registration payload only says that 8, 16, 24, and 32 are allowed values.

https://pages.nist.gov/ACVP/draft-hammett-acvp-kas-kdf-twostep.html#section-7.2.2

[AlexThurston]

Here is an example of the registration:

{
    "algorithm": "KDA",
    "revision": "Sp800-56Cr2",
    "mode": "TwoStep",
    "l": 1024,
    "z": [
        512
    ],
    "capabilities": [
        {
            "kdfMode": "feedback",
            "macMode": [
                "CMAC-AES128",
                "CMAC-AES192",
                "CMAC-AES256",
                "HMAC-SHA-1",
                "HMAC-SHA2-224",
                "HMAC-SHA2-256",
                "HMAC-SHA2-384",
                "HMAC-SHA2-512",
                "HMAC-SHA2-512/224",
                "HMAC-SHA2-512/256",
                "HMAC-SHA3-224",
                "HMAC-SHA3-256",
                "HMAC-SHA3-384",
                "HMAC-SHA3-512"
            ],
            "encoding": [
                "concatenation"
            ],
            "counterLength": [
                8,
                16,
                24,
                32
            ],
            "fixedDataOrder": [
                "none",
                "before fixed data",
                "after fixed data",
                "before iterator"
            ],
            "macSaltMethods": [
                "default",
                "random"
            ],
            "requiresEmptyIv": false,
            "supportsEmptyIv": false,
            "fixedInfoPattern": "l||label||uPartyInfo||vPartyInfo||context",
            "supportedLengths": [
                1024
            ]
        }
    ],
    "auxSharedSecretLen": [
        {
            "max": 1024,
            "min": 128,
            "increment": 8
        }
    ],
    "usesHybridSharedSecret": true,
    "performMultiExpansionTests": false
}

counterLength does not have 0 and the registration request fails.

[jbrock24]

Thanks for pointing this out. This is a requirement, here we call the KDF validation and the docs should match, #1499 takes care of it.

Appreciate the help!