[MLS] draft-ietf-mls-pq-ciphersuites: how are MLS Extract/Expand realized with SHAKE256?

[Emil Abramov <[e-mail]>]

Hello,

draft-ietf-mls-pq-ciphersuites-04 sets SHAKE256 as the KDF for all nine
cipher suites, but I can't find where the key schedule's KDF operations are
pinned down for it, and I wanted to check whether I'm missing something.
I'm also reading the current editor's copy
<https://messaginglayersecurity.rocks/mls-pq-ciphersuites/draft-ietf-mls-pq-ciphersuites.html>,
which matches, along with hpke-pq-04
<https://www.ietf.org/archive/id/draft-ietf-hpke-pq-04.txt>, hpke-hpke-03
<https://www.ietf.org/archive/id/draft-ietf-hpke-hpke-03.txt>, and RFC 9420
<https://www.rfc-editor.org/rfc/rfc9420.html>.

RFC 9420 Section 8 <https://www.rfc-editor.org/rfc/rfc9420.html#section-8>
builds the key schedule out of KDF.Extract(salt, ikm) and KDF.Expand(prk,
info, L). In the base suites the KDF is HKDF, so those map directly.
SHAKE256 is registered in hpke-pq as a one-stage KDF (Section 5, Table 1
<https://www.ietf.org/archive/id/draft-ietf-hpke-pq-04.txt>, "Two-Stage:
N"), and hpke-hpke-03 Section 4.2
<https://www.ietf.org/archive/id/draft-ietf-hpke-hpke-03.txt> only defines
Extract/Expand for two-stage KDFs, giving one-stage KDFs a single Derive
instead. So for these suites it isn't clear to me what KDF.Extract and
KDF.Expand actually compute.

hpke-hpke handles this internally by giving every affected function a
_OneStage variant that collapses to LabeledDerive, but that covers HPKE's
own operations, not the MLS key schedule. A couple of spots don't collapse
cleanly anyway, in particular the PSK chain in Section 8.4
<https://www.rfc-editor.org/rfc/rfc9420.html#section-8.4>, where an Extract
output is used as a PRK and then fed as the ikm of the next Extract.
There's also the label question, since MLS uses "MLS 1.0 " rather than
HPKE's "HPKE-v1", so borrowing HPKE's derivation directly wouldn't
reproduce MLS's bytes.

Is the intent that implementations define their own Extract/Expand over
SHAKE256, or should the cipher suites be restricted to two-stage KDFs, or
is this meant to be specified somewhere I haven't looked? If it's left to
implementations, two interoperable stacks could end up deriving different
epoch secrets. Happy to send a PR once the intended direction is clear.


Cheers,

Emil
-- 

---
*Emil Abramov*  l  Sr. Security Engineer
Wire™ <https://wire.com/en> – Protecting Confidential Communication

Wire user: @[e-mail]

*Wire Germany GmbH  *l  Rosenthaler Straße 41, 10178 Berlin, Germany

Geschäftsführer/Managing Director:
Benjamin François Schilz

HRB 149847 beim Handelsregister Charlottenburg, Berlin

VAT-ID DE288748675
This email and any files transmitted with it are confidential and intended
solely for the use of the individual or entity to whom they are addressed.
If you have received this email in error, please notify the sender. This
message contains confidential information and is intended only for the
individual named. If you are not the named addressee, you should not
disseminate, distribute or copy this email. Please notify the sender
immediately by e-mail if you have received this email by mistake and delete
this email from your system. If you are not the intended recipient, you are
notified that disclosing, copying, distributing or taking any action in
reliance on the contents of this information is strictly prohibited. /
Diese E-Mail und alle mit ihr übermittelten Dateien sind vertraulich und
ausschließlich für die Verwendung durch die Person oder Einheit bestimmt,
an die sie gerichtet sind.  Sollten Sie diese E-Mail irrtümlich erhalten
haben, benachrichtigen Sie bitte den Absender. Diese Nachricht enthält
vertrauliche Informationen und ist nur für die genannte Person
bestimmt. Wenn Sie nicht der genannte Adressat sind, sollten Sie diese
E-Mail nicht verbreiten, weitergeben oder kopieren. Bitte benachrichtigen
Sie den Absender unverzüglich per E-Mail, wenn Sie diese E-Mail
fälschlicherweise erhalten haben, und löschen Sie diese E-Mail aus Ihrem
System. Wenn Sie nicht der beabsichtigte Empfänger sind, werden Sie darauf
hingewiesen, dass die Weitergabe, das Kopieren, die Verteilung oder jede
Handlung im Vertrauen auf den Inhalt dieser Informationen streng verboten
ist.