[MLS] KDF instead of hashing up the tree

[Konrad Kohbrok <[e-mail]>]

Hey everyone,

I just discussed the current draft with my advisor Chris Brzuska and he came up
with a suggestion that I thought I'd just quickly relay here. As I have only
started following the discussion recently, I apologize if this was already
brought up in the past.

In terms of key separation, wouldn't it make for a cleaner design, if we used a
KDF instead of a hash function? Instead of  generating a new leaf-node secret
and then hashing it to compute the new secret for the parent node, it would be
better to generate a new secret and then from that secret independently (i.e.
with different labels) compute the new leaf secret and the new secret for the
parent node. This key independence would also make the proof easier. In terms of
overhead, this would mean two KDF operations instead of one hashing operation.

Cheers,
Konrad