Re: [kitten] shepherd review of draft-aes-cts-hmac-sha2-09

[Luke Howard <[e-mail]>]

> The one item which would potentially affect the actual protocol: at the
> end of Section 5, the pseudo-random function seems to be using a SP800-108
> KDF but omits the zero byte between label and context.  I think it would
> be better to have the zero byte -- do you remember whether there was a
> reason to omit it?  (Adding the zero byte would require re-rolling some
> test vectors, to be clear.)

The PRF is defined in terms of KDF-HMAC-SHA2() which implicitly inserts the zero byte when invoking HMAC-SHA-256(), e.g.:

	PRF = KDF-HMAC-SHA2(base-key, "prf" | octet-string, 256)
	= k-truncate(HMAC-SHA-256(key, 0x00000001 | "prf" | octet-string | 0x00 | 256))

if I’m not mistaken? Pretty sure our implementation passed the test vectors.

— Luke