cm/dem/kuznechik-ctr-hmac-kr

    Kuznechik-CTR-HMAC with key ratcheting DEM.
    [cm/encrypted/]'s "/dem/a" equals to "kuznechik-ctr-hmac-kr".
    CEK is 64 bytes long.
    Data is split on 128 KiB chunks, each of which is encrypted the following way:

        H = Streebog-512
        CK{-1} = CEK
        CKi = HKDF-Expand(H,
            prk=HKDF-Extract(H, salt="", ikm=CK{i-1}),
            info="cm/encrypted/kuznechik-ctr-hmac-kr/kr")
        Kenc = HKDF-Expand(H, prk=CKi,
            info="cm/encrypted/kuznechik-ctr-hmac-kr/enc")
        IV = HKDF-Expand(H, len=8, prk=CKi,
            info="cm/encrypted/kuznechik-ctr-hmac-kr/iv")
        Kauth || KauthTail = HKDF-Expand(H, prk=CKi,
            info="cm/encrypted/kuznechik-ctr-hmac-kr/auth")
        CIPHERTEXT = Kuznechik-CTR(key=Kenc, ctr=IV, data=chunk)
        CIPHERTEXT || HMAC(Streebog-256, key={Kauth|KauthTail}, data=CIPHERTEXT)

    Chaining key (CK) advances with every chunk. 256-bit encryption key and
    randomised 64-bit nonce (initialisation vector) are derived from it.

    KauthTail is used only in the last chunk to explicitly signal
    that it is the last one.

    "/payload"'s chunk length equals to 128KiB+32 bytes.

    => RFC 5869, HKDF
    => RFC 2104, HMAC
    => RFC 7801, Kuznechik, GOST R 34.12-2015 encryption algorithm
    => RFC 6986, Streebog, GOST R 34.11-2012 hashing algorithm