[TLS] Re: New Version Notification for draft-sullivan-tls-xof-ciphers-00.txt

[Martin Thomson <[e-mail]>]

On Fri, Jul 31, 2026, at 17:08, John Mattsson wrote:
> Familiarizing myself further with deck functions, I have come to 
> understand that a deck function is a keyed function. However, I am not 
> particularly fond of the term “dec function”.

dec as in decimal or the work that sounds like something more crude?  Either way, I agree.  But it *is* an accepted term.

If a rename is on the cards (pun fully intended), it's a function that has (arbitrarily) extendable output that can be drawn at multiple points in an extendable input sequence.  So maybe XIXOF or XIMXOF (eXtendable Input with Multiple eXtendable Output Function).  Of course, forking state is so useful here as to be basically essential, so you might as well add another F somewhere (XIMFXOF) or just XIFXOF because forking implies multiplicity.

As for the basic problem of mapping to HKDF-Extract/HKDF-Expand...

Extract:
If you treat either salt or IKM as fixed size, you could just stack them to produce Extract.  The output (PRK) is the XIFXOF and its internal state.

The length thing is probably not a big deal because HMAC has that whole zero-pad ambiguity thing going already.  Though if you cared about fixing that bug, you could length-prefix.

Expand:
A state fork, plus stacking the info argument into the input in an unambiguous manner. This almost certainly needs a length prefix in the general case, but TLS doesn't need it because it already provides its own (it also packs the value of L in for good measure; a general thing might choose to do the same). This is followed by taking L from the resulting XIFXOF output.

Or did I miss something here?