Reading the implementation details of Signal's approach on double ratchet algorithm I noticed the following key derivation procedure for using AES-CBC with HMAC:

HKDF is used (...) to generate 80 bytes of output. (...) HKDF info is set to an application-specific byte sequence distinct from other uses of HKDF in the application. The HKDF output is divided into a 32-byte encryption key, a 32-byte authentication key, and a 16-byte IV.

So the following is proposed

HKDF-Extract(salt, mk) -> PRK
HKDF-Expand(PRK, 'distinct_info', 80) -> OKM

What is the advantage over expanding PRK 3 times for IV, AES-Key and MAC-Key by using the info parameter? e.g

HKDF-Extract(salt, mk) -> PRK
HKDF-Expand(PRK, 'distinct_info_iv', 16) -> IV
HKDF-Expand(PRK, 'distinct_info_aes', 32) -> AES Key
HKDF-Expand(PRK, 'distinct_info_mac', 32) -> MAC Key

The only thing I see is that the former approach is slightly more efficient by doing only a single expand (e.g. only 1 HMAC = 2 hashes) instead of 3. On the other side, as far as I understand HKDF, expanding multiple keys from the PRK is exactly the point of the 2-step approach and is also clearer to read and understand for developers who are less familiar with implementing security relevant protocols.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.