Subject: [MLS] Key Schedule: New Document

From: Chris Brzuska <[email-masked]>
Date: Sun, 26 Jul 2020 23:01:52 +0300

Hi all,

I still need to process and understand the key schedule interface 
requirements which Richard discussed yesterday. In the meanwhile, I 
would like to make available an update on the original proposal (w.r.t. 
the original interface) and a discussion, available here in a (short) 
document (high-level discussion, no proofs):

http://www.chrisbrzuska.de/2020-07-26-MLS.pdf

Main points of the document:

- In the cfrg meeting, it was suggested to call HKDF.Extract on all 
three keys. Page 1 explains why relying on this "direct extract" 
construction implies the assumption that HKDF.Extract is an Triple-PRF 
(or n-PRF if there are more keys).

- Hugo Krawczyk brought the issue of low-entropy key material to my 
attention which I find an interesting topic for MLS: Sessions last very 
long and, after many updates, one would hope that entropy accumulates 
such that the keys become pseudorandom even if individual keys might 
have low entropy. For this purpose, it would be better to replace xor by 
HKDF.Extract which additively combines the entropy of its inputs (which 
xor does not necessarily do, see linked document above). This is the 
main reason why I favor to replace xor by HKDF.Extract. For a more 
nuanced discussion of pros and cons, see above document.

Chris