Re: [Sframe] Question about the use of HKDF-Extract

Hi Marta,

Thanks for taking a look.  Your proposed structure looks good to me.
Please send a PR!

Cheers,
--Richard

On Thu, Aug 3, 2023 at 10:00 AM Mularczyk, Marta <mulmarta=
40amazon.ch@dmarc.ietf.org> wrote:

> Hi all!
>
> First of all, I think it's a great protocol, super simple and useful.
>
> Now my actual small question. I noticed that derive_key_salt uses the HKDF
> in a bit non-standard way. Is there a reason for this, or can we use the
> "more standard" way I propose below? If people like the idea, I'm happy to
> draft a PR. In detail, the draft states
>
>    sframe_secret = HKDF-Extract("SFrame 1.0 Secret " + KID, base_key)
>    sframe_key = HKDF-Expand(sframe_secret, "key", AEAD.Nk)
>    sframe_salt = HKDF-Expand(sframe_secret, "salt", AEAD.Nn)
>
> The way HKDF-Extract is typically used is
> HKDF-Extract(optional_random_salt, base_key). On the other hand, the
> "domain separation" achieved by the label "SFrame 1.0 Secret " + KID
> typically happens in HKDF-Expand. So a more standard way seems to be
>
>    sframe_secret = HKDF-Extract("", base_key)
>    sframe_key = HKDF-Expand(sframe_secret, "SFrame 1.0 Secret key " + KID,
> AEAD.Nk)
>    sframe_salt = HKDF-Expand(sframe_secret, "SFrame 1.0 Secret salt " +
> KID, AEAD.Nn)
>
> This also aligns with MLS, which computes (below the Label is e.g.
> "joiner")
>
>    ExpandWithLabel(Secret, Label, Context, Length) = KDF.Expand(Secret,
> {length, "MLS 1.0 " + label, Context}, Length)
>
> FWIW, my explanation (in very loose terms) of the "more standard"
> derivation would be that the call to HKDF-Extract genertes a uniform key
> from a possibly non-uniform key provided by the application, while the
> HKDF-Expand calls generate 2 uniform keys from a uniform key.
>
> Best,
> Marta
>
> --
> Sframe mailing list
> Sframe@ietf.org
> https://www.ietf.org/mailman/listinfo/sframe
>