Reading the implementation details of Signal's approach on double ratchet algorithm I noticed the following key derivation procedure for using AES-CBC with HMAC:

HKDF is used (...) to generate 80 bytes of output. (...) HKDF info is set to an application-specific byte sequence distinct from other uses of HKDF in the application. The HKDF output is divided into a 32-byte encryption key, a 32-byte authentication key, and a 16-byte IV.

So the following is proposed

HKDF-Extract(salt, mk) -> PRK
HKDF-Expand(PRK, 'distinct_info', 80) -> OKM

What is the advantage over expanding PRK 3 times for IV, AES-Key and MAC-Key by using the info parameter? e.g

HKDF-Extract(salt, mk) -> PRK
HKDF-Expand(PRK, 'distinct_info_iv', 16) -> IV
HKDF-Expand(PRK, 'distinct_info_aes', 32) -> AES Key
HKDF-Expand(PRK, 'distinct_info_mac', 32) -> MAC Key

The only thing I see is that the former approach is slightly more efficient by doing only a single expand (e.g. only 1 HMAC = 2 hashes) instead of 3. On the other side, as far as I understand HKDF, expanding multiple keys from the PRK is exactly the point of the 2-step approach and is also clearer to read and understand for developers who are less familiar with implementing security relevant protocols.


Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.