Crypto: Added SHA256-based KDF for session key derivation from ECDH shared secret

src/secure_channel.c

@@ -130,6 +130,18 @@ static sc_status_t verify_and_strip_crc32(uint8_t *plaintext_with_crc, size_t to
     return SC_OK;
 }
 
+static void sc_derive_session_key(const uint8_t *shared_secret, uint8_t *session_key) {
+    SC_SHA256_CTX sha_ctx;
+    uint8_t hash[SC_HASH_SIZE];
+
+    sc_sha256_init(&sha_ctx);
+    sc_sha256_update(&sha_ctx, shared_secret, SC_SHARED_SECRET_SIZE);
+    sc_sha256_update(&sha_ctx, (const uint8_t *)"uTun-v3-session", 15);
+    sc_sha256_final(&sha_ctx, hash);
+
+    memcpy(session_key, hash, SC_SESSION_KEY_SIZE);
+}
+
 #ifdef USE_OPENSSL
 
 // OpenSSL-specific implementations
@@ -319,7 +331,7 @@ sc_status_t sc_set_peer_public_key(sc_context_t *ctx, const char *peer_public_ke
         EC_GROUP_free(group);
         return SC_ERR_CRYPTO;
     }
-    memcpy(ctx->session_key, shared_secret, SC_SESSION_KEY_SIZE);
+    sc_derive_session_key(shared_secret, ctx->session_key);
     memcpy(ctx->peer_public_key, peer_public_key, SC_PUBKEY_SIZE);
     ctx->peer_key_set = 1;
     ctx->session_ready = 1;
@@ -647,8 +659,7 @@ sc_status_t sc_set_peer_public_key(sc_context_t *ctx, const char *peer_public_ke
         return SC_ERR_CRYPTO;
     }
 
-    /* Derive session key from shared secret (simple copy for demo) */
+    sc_derive_session_key(shared_secret, ctx->session_key);
-    memcpy(ctx->session_key, shared_secret, SC_SESSION_KEY_SIZE);
 
     /* Store peer public key */
     memcpy(ctx->peer_public_key, peer_public_key, SC_PUBKEY_SIZE);