Description of problem:
In bug 2141695, we implemented an indicator for short input key lengths used in the KBKDF for OpenSSL, since we assumed that the restriction defined in SP 800-131Ar2 section 8 refers to SP 800-108 KDFs (which are what's implemented by OpenSSL as "KBKDF").

Further communication with our lab suggests that this limitation should apply to all KDFs (except PBKDF2 where we already have different limits implemented), and should also apply to KDF output key lengths.

Specifically, FIPS 140-3 IG D.B has a table that shows that any algorithm at a security strength < 112 bits is legacy use only, and SP 800-131Ar2 section 1.2.1 has similar wording.


Version-Release number of selected component (if applicable):
openssl-3.0.1-44.el9_0.1

How reproducible:
Run the kdf2.c reproducer from https://bugzilla.redhat.com/show_bug.cgi?id=2160733 with short input key lengths or short output key lengths.

Actual results:
Explicit FIPS indicator is not present or still approved despite short key length.

Expected results:
Explicit FIPS indicator marks these uses as not approved.

Additional info:
Note that the length of the derived key is only passed on invocation of EVP_KDF_derive() and not available in the parameters earlier. This means that the indicator will only indicate that this operation was not approved *after* the operation.