Split out of #37344.
Based on the FIPS 198 specification. Not optimized and probably completely unsafe, to be used only for non-strong-cryptographic purposes when OpenSSL cannot be used.