func (t *Crypto) convertRecKeyAndGenOrGetEPKEC(recPubKey *cryptoapi.PublicKey,
	prvEPK *cryptoapi.PrivateKey) (*ecdsa.PublicKey, *ecdsa.PrivateKey,
	error) {
	c, err := t.ecKW.getCurve(recPubKey.Curve)
	if err != nil {
		return nil, nil, fmt.Errorf("convertRecKeyAndGenOrGetEPKEC: failed to get curve of recipient key: %w",
			err)
	}
	recECPubKey := &ecdsa.PublicKey{
		Curve: c,
		X:     new(big.Int).SetBytes(recPubKey.X),
		Y:     new(big.Int).SetBytes(recPubKey.Y),
	}
	if prvEPK == nil {
		ephemeralPrivKey, err := t.ecKW.generateKey(recECPubKey.Curve)
		if err != nil {
			return nil, nil, fmt.Errorf("convertRecKeyAndGenOrGetEPKEC: failed to generate EPK: %w", err)
		}
		return recECPubKey, ephemeralPrivKey.(*ecdsa.PrivateKey), nil
	}
	return recECPubKey, &ecdsa.PrivateKey{
		PublicKey: ecdsa.PublicKey{
			Curve: c,
			X:     new(big.Int).SetBytes(prvEPK.PublicKey.X),
			Y:     new(big.Int).SetBytes(prvEPK.PublicKey.Y),
		},
		D: new(big.Int).SetBytes(prvEPK.D),
	}, nil
}
convertRecKeyAndGenOrGetEPKEC converts recPubKey into *ecdsa.PublicKey and generates an ephemeral EC private key
as *ecdsa.PrivateKey.
package tinkcrypto
import (
	"crypto/ecdsa"
	"crypto/elliptic"
	"encoding/base64"
	"errors"
	"fmt"
	"math/big"
	hybrid "github.com/google/tink/go/hybrid/subtle"
	"github.com/google/tink/go/keyset"
	josecipher "github.com/square/go-jose/v3/cipher"
	"golang.org/x/crypto/chacha20poly1305"
	"golang.org/x/crypto/curve25519"
	cryptoapi "github.com/hyperledger/aries-framework-go/pkg/crypto"
	"github.com/hyperledger/aries-framework-go/pkg/crypto/tinkcrypto/primitive/aead/subtle"
	"github.com/hyperledger/aries-framework-go/pkg/crypto/tinkcrypto/primitive/composite/keyio"
	ecdhpb "github.com/hyperledger/aries-framework-go/pkg/crypto/tinkcrypto/primitive/proto/ecdh_aead_go_proto"
	"github.com/hyperledger/aries-framework-go/pkg/internal/cryptoutil"
)
const defKeySize = 32
func (t *Crypto) deriveKEKAndWrap(cek, apu, apv, tag []byte, senderKH interface{}, recPubKey *cryptoapi.PublicKey,
	epkPrv *cryptoapi.PrivateKey, useXC20PKW bool) (*cryptoapi.RecipientWrappedKey, error) {
	var (
		kek         []byte
		epk         *cryptoapi.PublicKey
		wrappingAlg string
		err         error
	)
	if senderKH != nil {  
		wrappingAlg, kek, epk, apu, err = t.derive1PUKEK(len(cek), apu, apv, tag, senderKH, recPubKey, epkPrv,
			useXC20PKW)
		if err != nil {
			return nil, fmt.Errorf("deriveKEKAndWrap: error ECDH-1PU kek derivation: %w", err)
		}
	} else {  
		wrappingAlg, kek, epk, apu, err = t.deriveESKEK(apu, apv, recPubKey, useXC20PKW)
		if err != nil {
			return nil, fmt.Errorf("deriveKEKAndWrap: error ECDH-ES kek derivation: %w", err)
		}
	}
	return t.wrapRaw(kek, cek, apu, apv, wrappingAlg, recPubKey.KID, epk, useXC20PKW)
}
func (t *Crypto) wrapRaw(kek, cek, apu, apv []byte, alg, kid string, epk *cryptoapi.PublicKey,
	useXC20PKW bool) (*cryptoapi.RecipientWrappedKey, error) {
	var wk []byte
	if useXC20PKW {  
		aead, err := t.okpKW.createPrimitive(kek)
		if err != nil {
			return nil, fmt.Errorf("deriveKEKAndWrap: failed to create new XC20P primitive: %w", err)
		}
		wk, err = t.okpKW.wrap(aead, cek)
		if err != nil {
			return nil, fmt.Errorf("deriveKEKAndWrap: failed to XC20P wrap key: %w", err)
		}
	} else {  
		block, err := t.ecKW.createPrimitive(kek)
		if err != nil {
			return nil, fmt.Errorf("deriveKEKAndWrap: failed to create new AES Cipher: %w", err)
		}
		wk, err = t.ecKW.wrap(block, cek)
		if err != nil {
			return nil, fmt.Errorf("deriveKEKAndWrap: failed to AES wrap key: %w", err)
		}
	}
	return &cryptoapi.RecipientWrappedKey{
		KID:          kid,
		EncryptedCEK: wk,
		EPK:          *epk,
		APU:          apu,
		APV:          apv,
		Alg:          alg,
	}, nil
}
func (t *Crypto) deriveKEKAndUnwrap(alg string, encCEK, apu, apv, tag []byte, epk *cryptoapi.PublicKey, senderKH,
	recKH interface{}) ([]byte, error) {
	var (
		kek []byte
		err error
	)
	recPrivKH, ok := recKH.(*keyset.Handle)
	if !ok {
		return nil, fmt.Errorf("deriveKEKAndUnwrap: %w", errBadKeyHandleFormat)
	}
	recipientPrivateKey, err := extractPrivKey(recPrivKH)
	if err != nil {
		return nil, fmt.Errorf("deriveKEKAndUnwrap: %w", err)
	}
	switch alg {
	case ECDH1PUA128KWAlg, ECDH1PUA192KWAlg, ECDH1PUA256KWAlg, ECDH1PUXC20PKWAlg:
		kek, err = t.derive1PUKEKForUnwrap(alg, apu, apv, tag, epk, senderKH, recipientPrivateKey)
		if err != nil {
			return nil, fmt.Errorf("deriveKEKAndUnwrap: error ECDH-1PU kek derivation: %w", err)
		}
	case ECDHESA256KWAlg, ECDHESXC20PKWAlg:
		kek, err = t.deriveESKEKForUnwrap(alg, apu, apv, epk, recipientPrivateKey)
		if err != nil {
			return nil, fmt.Errorf("deriveKEKAndUnwrap: error ECDH-ES kek derivation: %w", err)
		}
	default:
		return nil, fmt.Errorf("deriveKEKAndUnwrap: unsupported JWE KW Alg '%s'", alg)
	}
	return t.unwrapRaw(alg, kek, encCEK)
}
func (t *Crypto) unwrapRaw(alg string, kek, encCEK []byte) ([]byte, error) {
	var wk []byte
	switch alg {
	case ECDHESXC20PKWAlg, ECDH1PUXC20PKWAlg:  
		aead, err := t.okpKW.createPrimitive(kek)
		if err != nil {
			return nil, fmt.Errorf("deriveKEKAndUnwrap: failed to create new XC20P primitive: %w", err)
		}
		wk, err = t.okpKW.unwrap(aead, encCEK)
		if err != nil {
			return nil, fmt.Errorf("deriveKEKAndUnwrap: failed to XC20P unwrap key: %w", err)
		}
	case ECDHESA256KWAlg, ECDH1PUA128KWAlg, ECDH1PUA192KWAlg, ECDH1PUA256KWAlg:
		block, err := t.ecKW.createPrimitive(kek)
		if err != nil {
			return nil, fmt.Errorf("deriveKEKAndUnwrap: failed to create new AES Cipher: %w", err)
		}
		wk, err = t.ecKW.unwrap(block, encCEK)
		if err != nil {
			return nil, fmt.Errorf("deriveKEKAndUnwrap: failed to AES unwrap key: %w", err)
		}
	default:
		return nil, fmt.Errorf("deriveKEKAndUnwrap: cannot unwrap with bad kw alg: '%s'", alg)
	}
	return wk, nil
}
func (t *Crypto) derive1PUKEK(cekSize int, apu, apv, tag []byte, senderKH interface{}, recPubKey *cryptoapi.PublicKey,
	epkPrv *cryptoapi.PrivateKey, useXC20PKW bool) (string, []byte, *cryptoapi.PublicKey, []byte, error) {
	var (
		kek         []byte
		epk         *cryptoapi.PublicKey
		err         error
		wrappingAlg string
	)
	two := 2
	if useXC20PKW {
		wrappingAlg = ECDH1PUXC20PKWAlg
	} else {
		switch cekSize {
		case subtle.AES128Size * two:
			wrappingAlg = ECDH1PUA128KWAlg
		case subtle.AES192Size * two:
			wrappingAlg = ECDH1PUA192KWAlg
		case subtle.AES256Size * two:
			wrappingAlg = ECDH1PUA256KWAlg
		default:
			return "", nil, nil, nil, fmt.Errorf("derive1PUKEK: invalid CBC-HMAC key size %d", cekSize)
		}
	}
	switch recPubKey.Type {
	case ecdhpb.KeyType_EC.String():
		wrappingAlg, kek, epk, apu, err = t.derive1PUWithECKey(wrappingAlg, apu, apv, tag, senderKH, recPubKey, epkPrv)
		if err != nil {
			return "", nil, nil, nil, fmt.Errorf("derive1PUKEK: EC key derivation error %w", err)
		}
	case ecdhpb.KeyType_OKP.String():
		wrappingAlg, kek, epk, apu, err = t.derive1PUWithOKPKey(wrappingAlg, apu, apv, tag, senderKH, recPubKey, epkPrv)
		if err != nil {
			return "", nil, nil, nil, fmt.Errorf("derive1PUKEK: OKP key derivation error %w", err)
		}
	default:
		return "", nil, nil, nil, errors.New("derive1PUKEK: invalid recipient key type for ECDH-1PU")
	}
	return wrappingAlg, kek, epk, apu, nil
}
func (t *Crypto) derive1PUKEKForUnwrap(alg string, apu, apv, tag []byte, epk *cryptoapi.PublicKey, senderKH interface{},
	recipientPrivateKey interface{}) ([]byte, error) {
	var (
		kek []byte
		err error
	)
	if senderKH == nil {
		return nil, fmt.Errorf("derive1PUKEKForUnwrap: sender's public keyset handle option is required for '%s'",
			ECDH1PUA256KWAlg)
	}
	switch epk.Type {
	case ecdhpb.KeyType_EC.String():
		kek, err = t.derive1PUWithECKeyForUnwrap(alg, apu, apv, tag, epk, senderKH, recipientPrivateKey)
		if err != nil {
			return nil, fmt.Errorf("derive1PUKEKForUnwrap: EC key derivation error %w", err)
		}
	case ecdhpb.KeyType_OKP.String():
		kek, err = t.derive1PUWithOKPKeyForUnwrap(alg, apu, apv, tag, epk, senderKH, recipientPrivateKey)
		if err != nil {
			return nil, fmt.Errorf("derive1PUKEKForUnwrap: OKP key derivation error %w", err)
		}
	default:
		return nil, errors.New("derive1PUKEKForUnwrap: invalid EPK key type for ECDH-1PU")
	}
	return kek, nil
}
func (t *Crypto) deriveESKEK(apu, apv []byte, recPubKey *cryptoapi.PublicKey,
	useXC20PKW bool) (string, []byte, *cryptoapi.PublicKey, []byte, error) {
	var (
		kek         []byte
		epk         *cryptoapi.PublicKey
		wrappingAlg string
		err         error
	)
	switch recPubKey.Type {
	case ecdhpb.KeyType_EC.String():
		wrappingAlg, kek, epk, apu, err = t.deriveESWithECKey(apu, apv, recPubKey, useXC20PKW)
		if err != nil {
			return "", nil, nil, nil, fmt.Errorf("deriveESKEK: error %w", err)
		}
	case ecdhpb.KeyType_OKP.String():
		wrappingAlg, kek, epk, apu, err = t.deriveESWithOKPKey(apu, apv, recPubKey, useXC20PKW)
		if err != nil {
			return "", nil, nil, nil, fmt.Errorf("deriveESKEK: error %w", err)
		}
	default:
		return "", nil, nil, nil, errors.New("deriveESKEK: invalid recipient key type for ECDH-ES")
	}
	return wrappingAlg, kek, epk, apu, nil
}
func (t *Crypto) deriveESKEKForUnwrap(alg string, apu, apv []byte, epk *cryptoapi.PublicKey,
	recipientPrivateKey interface{}) ([]byte, error) {
	var (
		kek []byte
		err error
	)
	switch epk.Type {
	case ecdhpb.KeyType_EC.String():
		kek, err = t.deriveESWithECKeyForUnwrap(alg, apu, apv, epk, recipientPrivateKey)
		if err != nil {
			return nil, fmt.Errorf("deriveESKEKForUnwrap: error: %w", err)
		}
	case ecdhpb.KeyType_OKP.String():
		kek, err = t.deriveESWithOKPKeyForUnwrap(alg, apu, apv, epk, recipientPrivateKey)
		if err != nil {
			return nil, fmt.Errorf("deriveESKEKForUnwrap: error: %w", err)
		}
	default:
		return nil, errors.New("deriveESKEKForUnwrap: invalid EPK key type for ECDH-ES")
	}
	return kek, nil
}
func (t *Crypto) derive1PUWithECKey(wrappingAlg string, apu, apv, tag []byte, senderKH interface{},
	recPubKey *cryptoapi.PublicKey, epkPrv *cryptoapi.PrivateKey) (string, []byte, *cryptoapi.PublicKey, []byte, error) {
	senderPrivKey, err := ksToPrivateECDSAKey(senderKH)
	if err != nil {
		return "", nil, nil, nil, fmt.Errorf("derive1PUWithECKey: failed to retrieve sender key: %w", err)
	}
	pubKey, ephemeralPrivKey, err := t.convertRecKeyAndGenOrGetEPKEC(recPubKey, epkPrv)
	if err != nil {
		return "", nil, nil, nil, err
	}
	ephemeralXBytes := ephemeralPrivKey.PublicKey.X.Bytes()
	if len(apu) == 0 {
		apu = make([]byte, base64.RawURLEncoding.EncodedLen(len(ephemeralXBytes)))
		base64.RawURLEncoding.Encode(apu, ephemeralXBytes)
	}
	keySize := aesCEKSize1PU(wrappingAlg)
	kek, err := t.ecKW.deriveSender1Pu(wrappingAlg, apu, apv, tag, ephemeralPrivKey, senderPrivKey, pubKey, keySize)
	if err != nil {
		return "", nil, nil, nil, fmt.Errorf("derive1PUWithECKey: failed to derive key: %w", err)
	}
	epk := &cryptoapi.PublicKey{
		X:     ephemeralXBytes,
		Y:     ephemeralPrivKey.PublicKey.Y.Bytes(),
		Curve: ephemeralPrivKey.PublicKey.Curve.Params().Name,
		Type:  recPubKey.Type,
	}
	return wrappingAlg, kek, epk, apu, nil
}
func (t *Crypto) derive1PUWithECKeyForUnwrap(alg string, apu, apv, tag []byte, epk *cryptoapi.PublicKey,
	senderKH interface{}, recipientPrivateKey interface{}) ([]byte, error) {
	var (
		senderPubKey *ecdsa.PublicKey
		epkCurve     elliptic.Curve
		err          error
	)
	senderPubKey, err = ksToPublicECDSAKey(senderKH, t.ecKW)
	if err != nil {
		return nil, fmt.Errorf("derive1PUWithECKeyForUnwrap: failed to retrieve sender key: %w", err)
	}
	epkCurve, err = t.ecKW.getCurve(epk.Curve)
	if err != nil {
		return nil, fmt.Errorf("derive1PUWithECKeyForUnwrap: failed to GetCurve: %w", err)
	}
	epkPubKey := &ecdsa.PublicKey{
		Curve: epkCurve,
		X:     new(big.Int).SetBytes(epk.X),
		Y:     new(big.Int).SetBytes(epk.Y),
	}
	recPrivECKey, ok := recipientPrivateKey.(*hybrid.ECPrivateKey)
	if !ok {
		return nil, errors.New("derive1PUWithECKeyForUnwrap: recipient key is not an EC key")
	}
	recPrivKey := hybridECPrivToECDSAKey(recPrivECKey)
	keySize := aesCEKSize1PU(alg)
	kek, err := t.ecKW.deriveRecipient1Pu(alg, apu, apv, tag, epkPubKey, senderPubKey, recPrivKey, keySize)
	if err != nil {
		return nil, fmt.Errorf("derive1PUWithECKeyForUnwrap: failed to derive kek: %w", err)
	}
	return kek, nil
}
func aesCEKSize1PU(alg string) int {
	keySize := defKeySize
	two := 2
	switch alg {
	case ECDH1PUA128KWAlg:
		keySize = subtle.AES128Size * two
	case ECDH1PUA192KWAlg:
		keySize = subtle.AES192Size * two
	case ECDH1PUA256KWAlg:
		keySize = subtle.AES256Size * two
	}
	return keySize
}
func (t *Crypto) deriveESWithECKeyForUnwrap(alg string, apu, apv []byte, epk *cryptoapi.PublicKey,
	recipientPrivateKey interface{}) ([]byte, error) {
	var (
		epkCurve elliptic.Curve
		err      error
	)
	epkCurve, err = t.ecKW.getCurve(epk.Curve)
	if err != nil {
		return nil, fmt.Errorf("deriveESWithECKeyForUnwrap: failed to GetCurve: %w", err)
	}
	epkPubKey := &ecdsa.PublicKey{
		Curve: epkCurve,
		X:     new(big.Int).SetBytes(epk.X),
		Y:     new(big.Int).SetBytes(epk.Y),
	}
	recPrivECKey, ok := recipientPrivateKey.(*hybrid.ECPrivateKey)
	if !ok {
		return nil, errors.New("deriveESWithECKeyForUnwrap: recipient key is not an EC key")
	}
	recPrivKey := hybridECPrivToECDSAKey(recPrivECKey)
	if recPrivKey.Curve != epkPubKey.Curve {
		return nil, errors.New("deriveESWithECKeyForUnwrap: recipient and ephemeral keys are not on the same curve")
	}
	return josecipher.DeriveECDHES(alg, apu, apv, recPrivKey, epkPubKey, defKeySize), nil
}
func (t *Crypto) deriveESWithECKey(apu, apv []byte, recPubKey *cryptoapi.PublicKey,
	useXC20PKW bool) (string, []byte, *cryptoapi.PublicKey, []byte, error) {
	wrappingAlg := ECDHESA256KWAlg
	if useXC20PKW {
		wrappingAlg = ECDHESXC20PKWAlg
	}
	recECPubKey, ephemeralPrivKey, err := t.convertRecKeyAndGenOrGetEPKEC(recPubKey, nil)
	if err != nil {
		return "", nil, nil, nil, fmt.Errorf("deriveESWithECKey: failed to generate ephemeral key: %w", err)
	}
	ephemeralXBytes := ephemeralPrivKey.PublicKey.X.Bytes()
	if len(apu) == 0 {
		apu = make([]byte, base64.RawURLEncoding.EncodedLen(len(ephemeralXBytes)))
		base64.RawURLEncoding.Encode(apu, ephemeralXBytes)
	}
	kek := josecipher.DeriveECDHES(wrappingAlg, apu, apv, ephemeralPrivKey, recECPubKey, defKeySize)
	epk := &cryptoapi.PublicKey{
		X:     ephemeralXBytes,
		Y:     ephemeralPrivKey.PublicKey.Y.Bytes(),
		Curve: ephemeralPrivKey.PublicKey.Curve.Params().Name,
		Type:  recPubKey.Type,
	}
	return wrappingAlg, kek, epk, apu, nil
}
func (t *Crypto) derive1PUWithOKPKey(wrappingAlg string, apu, apv, tag []byte, senderKH interface{},
	recPubKey *cryptoapi.PublicKey, epkPrv *cryptoapi.PrivateKey) (string, []byte, *cryptoapi.PublicKey, []byte, error) {
	senderPrivKey, err := ksToPrivateX25519Key(senderKH)
	if err != nil {
		return "", nil, nil, nil, fmt.Errorf("derive1PUWithOKPKey: failed to retrieve sender key: %w", err)
	}
	ephemeralPubKey, ephemeralPrivKey, err := t.generateOrGetEphemeralOKPKey(epkPrv)
	if err != nil {
		return "", nil, nil, nil, fmt.Errorf("derive1PUWithOKPKey: failed to generate ephemeral key: %w", err)
	}
	if len(apu) == 0 {
		apu = make([]byte, base64.RawURLEncoding.EncodedLen(len(ephemeralPubKey)))
		base64.RawURLEncoding.Encode(apu, ephemeralPubKey)
	}
	kek, err := t.okpKW.deriveSender1Pu(wrappingAlg, apu, apv, tag, ephemeralPrivKey, senderPrivKey, recPubKey.X,
		defKeySize)
	if err != nil {
		return "", nil, nil, nil, fmt.Errorf("derive1PUWithOKPKey: failed to derive key: %w", err)
	}
	epk := &cryptoapi.PublicKey{
		X:     ephemeralPubKey,
		Curve: "X25519",
		Type:  recPubKey.Type,
	}
	return wrappingAlg, kek, epk, apu, nil
}
func (t *Crypto) derive1PUWithOKPKeyForUnwrap(alg string, apu, apv, tag []byte, epk *cryptoapi.PublicKey,
	senderKH interface{}, recipientPrivateKey interface{}) ([]byte, error) {
	senderPubKey, err := ksToPublicX25519Key(senderKH)
	if err != nil {
		return nil, fmt.Errorf("derive1PUWithOKPKeyForUnwrap: failed to retrieve sender key: %w", err)
	}
	recPrivOKPKey, ok := recipientPrivateKey.([]byte)
	if !ok {
		return nil, errors.New("derive1PUWithOKPKeyForUnwrap: recipient key is not an OKP key")
	}
	kek, err := t.okpKW.deriveRecipient1Pu(alg, apu, apv, tag, epk.X, senderPubKey, recPrivOKPKey, defKeySize)
	if err != nil {
		return nil, fmt.Errorf("derive1PUWithOKPKeyForUnwrap: failed to derive kek: %w", err)
	}
	return kek, nil
}
func (t *Crypto) deriveESWithOKPKey(apu, apv []byte, recPubKey *cryptoapi.PublicKey,
	useXC20PKW bool) (string, []byte, *cryptoapi.PublicKey, []byte, error) {
	wrappingAlg := ECDHESA256KWAlg
	if useXC20PKW {
		wrappingAlg = ECDHESXC20PKWAlg
	}
	ephemeralPubKey, ephemeralPrivKey, err := t.generateOrGetEphemeralOKPKey(nil)
	if err != nil {
		return "", nil, nil, nil, fmt.Errorf("deriveESWithOKPKey: failed to generate ephemeral key: %w", err)
	}
	ephemeralPrivChacha := new([chacha20poly1305.KeySize]byte)
	copy(ephemeralPrivChacha[:], ephemeralPrivKey)
	recPubKeyChacha := new([chacha20poly1305.KeySize]byte)
	copy(recPubKeyChacha[:], recPubKey.X)
	if len(apu) == 0 {
		apu = make([]byte, base64.RawURLEncoding.EncodedLen(len(ephemeralPubKey)))
		base64.RawURLEncoding.Encode(apu, ephemeralPubKey)
	}
	z, err := cryptoutil.DeriveECDHX25519(ephemeralPrivChacha, recPubKeyChacha)
	if err != nil {
		return "", nil, nil, nil, fmt.Errorf("deriveESWithOKPKey: failed to derive 25519 kek: %w", err)
	}
	kek := kdf(wrappingAlg, z, apu, apv, chacha20poly1305.KeySize)
	epk := &cryptoapi.PublicKey{
		X:     ephemeralPubKey,
		Curve: "X25519",
		Type:  recPubKey.Type,
	}
	return wrappingAlg, kek, epk, apu, nil
}
func (t *Crypto) deriveESWithOKPKeyForUnwrap(alg string, apu, apv []byte, epk *cryptoapi.PublicKey,
	recipientPrivateKey interface{}) ([]byte, error) {
	recPrivOKPKey, ok := recipientPrivateKey.([]byte)
	if !ok {
		return nil, errors.New("deriveESWithOKPKeyForUnwrap: recipient key is not an OKP key")
	}
	recPrivKeyChacha := new([chacha20poly1305.KeySize]byte)
	copy(recPrivKeyChacha[:], recPrivOKPKey)
	epkChacha := new([chacha20poly1305.KeySize]byte)
	copy(epkChacha[:], epk.X)
	z, err := cryptoutil.DeriveECDHX25519(recPrivKeyChacha, epkChacha)
	if err != nil {
		return nil, fmt.Errorf("deriveESWithOKPKeyForUnwrap: %w", err)
	}
	return kdf(alg, z, apu, apv, chacha20poly1305.KeySize), nil
}