There is a system in which Alice and Bob need to establish a secure communication channel. Their conversation happens via a "public" server whose only purpose is to rely messages between users. This server must never be able to decrypt communications.
With the protocol that Alice and Boo will use, the first time they want to talk, Alice generates a 128-bit key that is able to exchange with Bob in person.
This is the only communication that Alice and Bob can have in a trusted manner (in person) before begin communicating through the server above mentioned. As stated, this communication is one-way (Alice-to-Bob) and Alice is only able to give bob at most 128 bits of data.
Now, Alice and Bob connect to that server and need to find each other by going in the same "stanza". Since the only knowledge that Alice and Bob have of each other to meet is that 128-bit key, they expand this key (using HKDF) to create:
- A 256-bit AES key for encryption.
- A 256-bit HMAC-SHA256 key for authentication.
- A 128-bit "stanza-id" that will be advertised publicly.
Since the server allows any client to choose any arbitrary stanza-id on where to sit and wait for messages, Alice and Bob are able to meet each other in the same stanza, and even if someone is able to listen to them, their communication is secure since it is encrypted and authenticated.
My questions are:
Does exposing part of the HKDF output publicly weak the other "private" parts or leak any other information?
Does it make sense to use AES-256 when the key originates from only 128-bits of entropy?
Does allowing any client to chose any arbitrary stanza-id put the server in danger in any way?