In TLS 1.3, is the first Derived Secret always a constant value (in non-PSK handshakes)?

Question

RFC 5869 Defines HKDF-Extract in section 2.2 as:

HKDF-Extract(salt, IKM) -> PRK

TLS 1.3 RFC 8446 defines the first part of the Key Schedule like this:

          0
          |
          v
PSK ->  HKDF-Extract = Early Secret
          | 
           ... <<< omitting unrelated lines >>> ...
          v
    Derive-Secret(., "derived", "")
          |
          v
(EC)DHE -> HKDF-Extract = Handshake Secret

And later confirms that if there is no PSK, the first Extract operation is on (0,0):

if PSK is not in use, Early Secret will still be HKDF-Extract(0, 0)

The result of HKDF-Extract(0, 0) will get fed into the Derive-Secret Operation as such:

Derive-Secret( [HKDF-Extract(0, 0)], "derive", "") 

Which doesn't include a transcript hash. Hence, this is put together from entirely prescribed values (0, 0, "derive").

Q: Does this mean this value, which is then combined with the result of the (EC)DHE, is always constant?

Effectively, an HKDF-Extract on (0,0), then an HKDF-Expand-Label on the result of the earlier Extract, plus the label "derived" plus an empty handshake transcript?

Answer 1

Q: Does this mean this value, which is then combined with the result of the (EC)DHE, is always constant?

Yes, the Early Secret Without pre-shared keys is always a constant value, i.e., $\mathrm{Extract(0,0)}$. As you point out, the same is true for the Derived Early Secret. This is fine since the latter value is used as salt to extract further keys from the DH shared secret.

Indeed, assuming a correct implementation, the key schedule uses ephemeral DH shares to compute a shared secret and then a handshake secret as follows: $\mathrm{HS} = \mathrm{Extract}(\mathrm{DES}, xy*G)$. Where: $\mathrm{HS}$ is the handshake secret, $\mathrm{DES}$ is the derived handshake secret used as the salt for $\mathrm{Extract}$, and finally, $xy*G$ is the DH shared secret.