EVP_PKEY_derive() might report a larger maximum size of the output than
HPKE_MAX_SHARED_SECRET_LEN under some conditions. That should be allowed
as long as the real final length is within the maximum limit.
Furthermore, since we are using a fixed length buffer for this, there is
no need to call EVP_PKEY_derive() twice to first learn the maximum
length. Use a bit longer buffer and allow OpenSSL to take care of the
update to the final length internally with than single call.
This showed up using the following test case sequence:
dbus_pkcs11 dpp_private_peer_introduction
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
820211245b