In RFC5869 I found that the function of the HKDF-Expand on the input assumes the parameter $L$ which denotes length of output keying material in octets ($\leq 255*\text{Hash}_{Length}$), and then the $N$ is computed as $\operatorname{ceil}(L/\text{Hash}_\text{Length})$ and $L$ is a multiple of $\text{Hash}_\text{Length}$, i.e. the number of output blocks equals $N\in [1,..,255]$.

But when analyzing the use of this function in TLS 1.3 to form a key schedule, I see that the input of this function for $L$ parameter is Hash.length when calling the Derive-Secret function for each generated key:

DeriveSecret(EarlySecret, "ext binder" | "res binder", "") = HKDF-Expand-Label(EarlySecret, "ext binder" | "res binder" | Hash(""), Hash.length ) = HKDF-Expand(EarlySecret, "ext binder" | "res binder" | Hash(""), Hash.length)

i.e. $L$ = Hash.length and $N = 1$? And so for each key.

I'm sure that I'm wrong somewhere but I do not understand where.

  • $\begingroup$ I made some edits to your question to hopefully improve the readability - please ensure that I did not accidentally change the meaning of your question. $\endgroup$ – Ella Rose Apr 22 '18 at 23:21
  • 1
    $\begingroup$ These keys don't seem to be directly used as session keys. A key the size of the hash makes sense as it provides the maximum of security, minimum of processing and it doesn't require any post-processing of the output keying material. $\endgroup$ – Maarten Bodewes Apr 25 '18 at 0:26
  • $\begingroup$ Maarten Bodewes, then what is the difference between the functions used to diversify the keys - HKDF.Extract and HKDF.Expand, if HKDF.Expand works for one round ? $\endgroup$ – Kirill Voevodin Apr 25 '18 at 9:18
  • $\begingroup$ Sorry if I could not get back to you at the time (life was happening to me in April 2018). Could you have a look at the given answer? HKDF Extract is used to compress entropy, HKDF expands compressed entropy using the given info and output size. I'm not sure why HKDF-Extract is not used for TLS. $\endgroup$ – Maarten Bodewes Dec 27 '18 at 15:30

As commented by Maarten Bodewes, derived secrects are not session keys. In TLS 1.3, a "derived secret" and a label are further fed into the HKDF.Expand function to generate the desired session/traffic key, secret nonce/IV, resumption key, etc. I think such an intermediate HKDF.Expand step makes a better key separation for security purpose, e.g., corrupting a traffic key intuitively leaks no information about a resumption key because they are not generated from the same "derived secret".

Btw, HKDF.Extract essentially converts a high-entropy input (not sampled from a uniform distribution), e.g., a DH result, to a fixed-length pseudorandom key, while HKDF.Expand takes a pseudorandom key and a label to generate a random string (which for example could be either a derived secret or a session key).


Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.