Re: [MLS] DeriveKeyPair IKM size

[Simon Ser <[e-mail]>]

On Friday, March 15th, 2024 at 00:52, Rohan Mahy <[e-mail]> wrote:

> The issue you are pointing out is an issue with HPKE (RFC9180) which
> was a product of the CFRG research group, and should probably be
> discussed there.

Hm, I'm not sure I understand. The issue I'm describing is about MLS'
usage of HPKE, due to the definition of node_priv:

    node_secret[n] = DeriveSecret(path_secret[n], "node")
    node_priv[n], node_pub[n] = KEM.DeriveKeyPair(node_secret[n])

And the definition of DeriveSecret:

    DeriveSecret(Secret, Label) =
        ExpandWithLabel(Secret, Label, "", KDF.Nh)

Specifically, the issue is that MLS:

1. Specifies that the output of DeriveSecret, which has the length KDF.Nh,
   is fed into KEM.DeriveKeyPair.
2. Defines a few cipher suites which combine a KEM and KDF resulting in
   a mismatch between KDF.Nh and KEM.Nsk. Specifically cipher suite 0x05
   passes an ikm parameter shorter than HPKE says it SHOULD.

> Note that [XWing], also contraindicates the SHOULD in [HPKE] Section
> 7.1.3, because 2432 octets of entropy is excessive, and 32 octets is
> expected to be sufficient.

That's not my reading of the spec: the HPKE RFC says that the "ikm parameter
given to DeriveKeyPair() SHOULD have length at least Nsk". The "at least" part
is key here: feeding a larger parameter satisfies the SHOULD.