[Sframe] MLS Integration Question

["Alwen, Joel" <[e-mail]>]

 _Hey everyone,


As Marta Mularczyk and I have been looking at using MLS to key SFrame we came across the following two questions/suggestions for the SFrame mailinglist.


1) Section 5.2 recommends how KIDs can be defined when using MLS as the key source. It domain separates between (epoch, leaf) pairs which is good. But by "only" domain separating on this it seems to imply that when encrypting frames from different streams (e.g. audio & video) from the same sender implementations need to coordinate the counter values in the SFrame header (lest the same IV is used more than once by the sender).  So, to make implementation easier / more flexible, we were thinking KID should also domain separate streams. E.g. the KID has an extra byte indicating the stream. That way encrypting different streams can be done independently and concurrently. Does that sound like a good idea to everyone? If so maybe we should update the SFrame MLS integration recommendation accordingly.

2) Another question about how KIDs are derived in section 5.2: to avoid reuse of the same key/nonce pairs in encryption due to "failure\crash -> resumption"  type scenarios maybe it would be a good idea to add a bit of entropy (say a byte) into KID that then goes in to the base_key generation. Basically, the suggestion is to have a similar mechanism to the nonce reuse guard in MLS (only this time its a key reuse guard).


3) Why recommend first generating sframe_epoch_secret as an Exporter and then doing HKDF-Expand again to generate individual base_keys? Is there an issue with just generating the base_keys directly as Exporter keys?


- Joël



Amazon Development Center Austria GmbH
Brueckenkopfgasse 1
8020 Graz
Oesterreich
Sitz in Graz
Firmenbuchnummer: FN 439453 f
Firmenbuchgericht: Landesgericht fuer Zivilrechtssachen Graz