后端用Java开发的，用到了org.bouncycastle.crypto.generators.KDF2BytesGenerator，一开始在网上各种搜，没找到相关的接口或第三方库，白白浪费了几天时间，后面才想到照着Java代码自己实现，于是乎参考BaseKDFBytesGenerator.java轻松搞定。

import Foundation
import CryptoKit


class KDF2BytesGenerator {
    
    static func generateBytes(shared: Array<UInt8>, iv: Array<UInt8>?) -> Array<UInt8> {
        var outOff = 0
        var len = 16
        let oBytes = len
        let outLen = SHA256.byteCount
        let cThreshold = (oBytes + outLen - 1) / outLen
        let counterStart = 1
        var out = Array<UInt8>(repeating: 0, count: oBytes)
        
        var C = Array<UInt8>(repeating: 0, count: 4)
        intToBigEndian(counterStart, &C, 0)
        
        var counterBase = counterStart & ~0xFF
        
        for _ in 0..<cThreshold {
            var digest = SHA256()
            digest.update(data: shared)
            digest.update(data: C)
            
            if (iv != nil)
            {
                digest.update(data: iv!)
            }
            
            let dig = digest.finalize().map { (e:UInt8) in
                e
            }
            
            if len > outLen {
                uint8ArrayCopy(dig, 0, &out, outOff, outLen)
                outOff += outLen
                len -= outLen
            } else {
                uint8ArrayCopy(dig, 0, &out, outOff, len)
            }
            
            if 1 + C[3] == 0 {
                C[3] += 1
                counterBase += 0x100
                intToBigEndian(counterBase, &C, 0)
            }
        }
        return out
    }
    
    static func uint8ArrayCopy(_ src: Array<UInt8>, _ srcPos: Int, _ dest: UnsafeMutablePointer<UInt8>, _ destPos: Int, _ length: Int) {
        let end = srcPos + length
        for i in srcPos..<end {
            dest[destPos + i - srcPos] = src[i]
        }
    }
    
    static func intToBigEndian(_ value: Int, _ arr: UnsafeMutablePointer<UInt8>, _ offset: Int) {
        arr[offset] = UInt8((value >> 24) & 0xff)
        arr[offset + 1] = UInt8((value >> 16) & 0xff)
        arr[offset + 2] = UInt8((value >> 8) & 0xff)
        arr[offset + 3] = UInt8(value & 0xff)
    }
}