[Sframe] Question about the use of HKDF-Extract

["Mularczyk, Marta" <[e-mail]>]

Hi all!

First of all, I think it's a great protocol, super simple and useful.

Now my actual small question. I noticed that derive_key_salt uses the HKDF in a bit non-standard way. Is there a reason for this, or can we use the "more standard" way I propose below? If people like the idea, I'm happy to draft a PR. In detail, the draft states

   sframe_secret = HKDF-Extract("SFrame 1.0 Secret " + KID, base_key)
   sframe_key = HKDF-Expand(sframe_secret, "key", AEAD.Nk)
   sframe_salt = HKDF-Expand(sframe_secret, "salt", AEAD.Nn)

The way HKDF-Extract is typically used is HKDF-Extract(optional_random_salt, base_key). On the other hand, the "domain separation" achieved by the label "SFrame 1.0 Secret " + KID typically happens in HKDF-Expand. So a more standard way seems to be

   sframe_secret = HKDF-Extract("", base_key)
   sframe_key = HKDF-Expand(sframe_secret, "SFrame 1.0 Secret key " + KID, AEAD.Nk)
   sframe_salt = HKDF-Expand(sframe_secret, "SFrame 1.0 Secret salt " + KID, AEAD.Nn)

This also aligns with MLS, which computes (below the Label is e.g. "joiner")

   ExpandWithLabel(Secret, Label, Context, Length) = KDF.Expand(Secret, {length, "MLS 1.0 " + label, Context}, Length)

FWIW, my explanation (in very loose terms) of the "more standard" derivation would be that the call to HKDF-Extract genertes a uniform key from a possibly non-uniform key provided by the application, while the HKDF-Expand calls generate 2 uniform keys from a uniform key.

Best,
Marta