Document that key agreement produces a maximum-capacity generator
diff --git a/library/psa_crypto.c b/library/psa_crypto.c
index c18c8f0..bc306cb 100644
--- a/library/psa_crypto.c
+++ b/library/psa_crypto.c
@@ -3371,6 +3371,15 @@
if( generator->alg == PSA_ALG_SELECT_RAW )
{
+ /* Initially, the capacity of a selection generator is always
+ * the size of the buffer, i.e. `generator->ctx.buffer.size`,
+ * abbreviated in this comment as `size`. When the remaining
+ * capacity is `c`, the next bytes to serve start `c` bytes
+ * from the end of the buffer, i.e. `size - c` from the
+ * beginning of the buffer. Since `generator->capacity` was just
+ * decremented above, we need to serve the bytes from
+ * `size - generator->capacity - output_length` to
+ * `size - generator->capacity`. */
size_t offset =
generator->ctx.buffer.size - generator->capacity - output_length;
memcpy( output, generator->ctx.buffer.data + offset, output_length );