Re: [MLS] DeriveKeyPair IKM size

Hi Simon,
The issue you are pointing out is an issue with HPKE (RFC9180) which was a
product of the CFRG research group, and should probably be discussed there.

That said, it seems like the intention was that ikm needs to have enough
entropy to maintain the target security level (twice the number of octets
as in the target security level).
Note that [XWing], also contraindicates the SHOULD in [HPKE] Section 7.1.3,
because 2432 octets of entropy is excessive, and 32 octets is expected to
be sufficient.

Thanks,
-rohan

[XWing]
https://www.ietf.org/archive/id/draft-connolly-cfrg-xwing-kem-01.html#name-use-in-hpke
[HPKE] https://www.rfc-editor.org/rfc/rfc9180.html#derive-key-pair

On Thu, Mar 14, 2024 at 9:18 AM Simon Ser <contact@emersion.fr> wrote:

> Hi,
>
> In [1] I reported that some MLS cipher suites will pass an IKM to
> DeriveKeyPair
> which doesn't match the recommendations of HPKE. The HPKE RFC says:
>
> > For a given KEM, the ikm parameter given to DeriveKeyPair() SHOULD have
> length
> > at least Nsk, and SHOULD have at least Nsk bytes of entropy.
>
> But MLS cipher suite 0x05 will pass an IKM with size 64, while Nsk = 66.
>
> Is this intentional?
>
> Simon
>
> [1]:
> https://github.com/cloudflare/circl/issues/486#issuecomment-1996056891
>
> _______________________________________________
> MLS mailing list
> MLS@ietf.org
> https://www.ietf.org/mailman/listinfo/mls
>