Expose XAES-256-GCM in AWS-LC-RS

[ttunglee]

Issue #, if available:

TL;DR

Briefly, XAES-256-GCM is AES-256-GCM but with larger nonce size (20 to 24 bytes) instead of 12 bytes, and it is integrated with a key derivation function, which derives a subkey prior to encryption and decryption to use rather than directly using the main key for encryption/decryption. Therefore, all test cases that apply to AES-256-GCM also apply to XAES-256-GCM, although the output ciphertexts of the two will be different.

XAES-256-GCM

XAES-256-GCM is extended AES-GCM with a derived-key mode proposed by Filippo Valsorda in 2023, followed by a specification released in 2024. Benhamouda et al. provides a formal proof for the security of XAES-256-GCM beyond the birthday bound with $$2^{80}$$ encryptions without key rotation in the unique-key/block model, and Kampanakis et al. introduces an extension to additionally support CMAC-based Key Commitment. The trade-off compared to the standard AES-GCM is a small computation cost incurred by invoking a key derivation function (KDF) for each encryption. Specifically, it requires three AES invocations for key derivation (in which one can be precomputed), and three more for key commitment. XAES-256-GCM uses FIPS-approved algorithms (CMAC-based KDF in NIST SP 800-38B and AES-GCM in NIST SP 800-38D).

XAES-256-GCM is implemented in branch xaes-256-gcm of AWS-LC repo: https://github.com/aws/aws-lc/tree/xaes-256-gcm, for both EVP_CIPHER and EVP_AEAD APIs.

See PR: aws/aws-lc#2809

Description of changes

Since module aead uses constant 96-bit nonce for all schemes, while XAES-256-GCM uses 160-192-bit nonce, a new module aead_xaes_256_gcm is added.

1. Manually add C signature of EVP_aead_xaes_256_gcm() into places that have EVP_aead_aes_256_gcm().
2. Create a module for XAES-256-GCM named aead_xaes_256_gcm by copying from available module aead, and change the nonce size everywhere to 24 bytes.
3. Add KATs to https://github.com/ttunglee/aws-lc-rs/blob/main/aws-lc-rs/tests/data/aead_xaes_256_gcm_tests.txt
4. Create a test file similar to aead_test.rs: https://github.com/ttunglee/aws-lc-rs/blob/main/aws-lc-rs/tests/XAes_256_Gcm_test.rs

** Testing**

cargo test aead_xaes_gcm_256

This test already passes for all sealer and opener pairs:
https://github.com/ttunglee/aws-lc-rs/blob/main/aws-lc-rs/tests/XAes_256_Gcm_test.rs#L24

Note: To get the xaes-256-gcm branch of AWS-LC as submodules:

git submodule sync --recursive
git submodule update --init --recursive --remote

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.