2
$\begingroup$

Reading the implementation details of Signal's approach on double ratchet algorithm I noticed the following key derivation procedure for using AES-CBC with HMAC:

HKDF is used (...) to generate 80 bytes of output. (...) HKDF info is set to an application-specific byte sequence distinct from other uses of HKDF in the application. The HKDF output is divided into a 32-byte encryption key, a 32-byte authentication key, and a 16-byte IV.

So the following is proposed

HKDF-Extract(salt, mk) -> PRK
HKDF-Expand(PRK, 'distinct_info', 80) -> OKM

What is the advantage over expanding PRK 3 times for IV, AES-Key and MAC-Key by using the info parameter? e.g

HKDF-Extract(salt, mk) -> PRK
HKDF-Expand(PRK, 'distinct_info_iv', 16) -> IV
HKDF-Expand(PRK, 'distinct_info_aes', 32) -> AES Key
HKDF-Expand(PRK, 'distinct_info_mac', 32) -> MAC Key

The only thing I see is that the former approach is slightly more efficient by doing only a single expand (e.g. only 1 HMAC = 2 hashes) instead of 3. On the other side, as far as I understand HKDF, expanding multiple keys from the PRK is exactly the point of the 2-step approach and is also clearer to read and understand for developers who are less familiar with implementing security relevant protocols.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.