Subject: [MLS] Double-use of the same key

From: Chris Brzuska <[email-masked]>
Date: Thu, 20 Aug 2020 21:40:14 +0300

Hey all,

I realized that that path_secret is now used to key two different 
cryptographic primitives which violates key separation. Namely, the 
path_secret is used to key the two functions ExpandWithLabel and 
KEM.DeriveKeyPair.

Downsides:

  * Violates the good crypto practice of key separation via HKDF.Expand
    which we use in other parts of MLS.
  * Moves MLS outside the scope of provable security, because crypto
    assumptions assume that a key is only used in one cryptographic
    primitive and not in two.

Chris

|path_secret[n] = ExpandWithLabel(path_secret[n-1], "path", "", KEM.Nsk) 
node_priv[n], node_pub[n] = KEM.DeriveKeyPair(path_secret[n])|

---

From: Richard Barnes <[email-masked]>
Date: Thu, 20 Aug 2020 17:04:52 -0400

Argh, we *used* to have an Expand call there, but got rid of it because the
first step of DeriveKeyPair was also Expand.  But now that we're delegating
to the KEM here, it probably makes sense to add it back, especially since
the first step of DeriveKeyPair is now Extract.

https://github.com/mlswg/mls-protocol/pull/397

I think I owe Konrad a beer since he initially proposed it and I reverted
it :)

--Richard

[1]
https://github.com/cfrg/draft-irtf-cfrg-hpke/blob/master/draft-irtf-cfrg-hpke.md#derivekeypair-derive-key-pair

On Thu, Aug 20, 2020 at 2:40 PM Chris Brzuska <[email-masked]>
wrote:

>    - Violates the good crypto practice of key separation via HKDF.Expand
>    - Moves MLS outside the scope of provable security, because crypto
>    assumptions assume that a key is only used in one cryptographic primitive
>    and not in two.
>
> Chris
>
> path_secret[n] = ExpandWithLabel(path_secret[n-1],
>                                    "path", "", KEM.Nsk)
> node_priv[n], node_pub[n] = KEM.DeriveKeyPair(path_secret[n])
>
> _______________________________________________
> MLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/mls
>

---

From: Chris Brzuska <[email-masked]>
Date: Fri, 21 Aug 2020 00:13:55 +0300

Excellent, thanks :-)

Chris

On 21/08/2020 00:04, Richard Barnes wrote:

> Argh, we *used* to have an Expand call there, but got rid of it 
> because the first step of DeriveKeyPair was also Expand.  But now that 
> we're delegating to the KEM here, it probably makes sense to add it 
> back, especially since the first step of DeriveKeyPair is now Extract.
>
> I think I owe Konrad a beer since he initially proposed it and I 
> reverted it :)
>
> --Richard
>
> [1] 
> On Thu, Aug 20, 2020 at 2:40 PM Chris Brzuska <[email-masked] 
> <mailto:[email-masked]>> wrote:
>
>     Hey all,
>
>     cryptographic primitives which violates key separation. Namely,
>     the path_secret is used to key the two functions ExpandWithLabel
>     and KEM.DeriveKeyPair.
>
>     Downsides:
>
>       * Violates the good crypto practice of key separation via
>         HKDF.Expand which we use in other parts of MLS.
>       * Moves MLS outside the scope of provable security, because
>         crypto assumptions assume that a key is only used in one
>         cryptographic primitive and not in two.
>
>     Chris
>
>     |path_secret[n] = ExpandWithLabel(path_secret[n-1], "path", "",
>     KEM.Nsk) node_priv[n], node_pub[n] = KEM.DeriveKeyPair(path_secret[n])|
>
>     [email-masked] <mailto:[email-masked]>