Skip to content

kem: Scheme.DeriveKeyPair length check too strict #486

@emersion

Description

@emersion

Scheme.DeriveKeyPair panics if the length of the seed is different from Scheme.SeedSize. However, this is too strict: there are use-cases for passing a seed larger than the hash size, for instance MLS passes a 64-byte value to KEM_X448_HKDF_SHA512 (which has SeedSize of 56).

RFC 9180 section 7.1.3 says:

For a given KEM, the ikm parameter given to DeriveKeyPair() SHOULD have length at least Nsk, and SHOULD have at least Nsk bytes of entropy.

Would you accept a patch which changes the len(seed) == x.SeedSize() check to len(seed) >= x.SeedSize()?

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions