Draft: draft-ietf-mls-protocol

Commentary: In , we changed from using HKDF to using the KDF from HPKE , which I thought removed the need for the ciphersuite to specify a hash function . As a result , ciphersuites no longer needed to specify a hash . However , the transcript computations still have a raw invocation , not a KDF invocation . So we need to either : the transcript hash computations to use the KDF , or that ciphersuites still specify a hash function ( as before ) 
 What about the call in the and the " hashes " for ? 
 Our HPKE dependency provides a perfectly usable KDF . We should just use that instead of nailing a dependency to HKDF . This will mainly be a matter of changing and calls to the corresponding calls on the HPKE KDF . 
 I ca n't wait to see the implementations . 
 Thanks for the enthusiasm , but I do n't think this is a spec issue :)
Paragraph (version A):
The ciphersuite's KEM used to instantiate an HPKE I-D.irtf-cfrg-hpke
instance for the purpose of public-key encryption.  Each ciphersuite
has a "Derive-Key-Pair" function that maps octet strings of length
"Nsk" (a KEM-specific constant defined by HPKE) to HPKE key pairs.
This function is defined to be HPKE's "DeriveKeyPair" function.
Paragraph (version B):
The HPKE parameters are used to instantiate HPKE I-D.irtf-cfrg-hpke
for the purpose of public-key encryption.  The "DeriveKeyPair"
function associated to the KEM for the ciphersuite maps octet strings
to HPKE key pairs.
Paragraph (version A):
Keys, nonces and secrets of ratchets are derived using Derive-App-
Secret.  The context in a given call consists of the index of the
sender's leaf in the ratchet tree and the current position in the
ratchet.  In particular, the index of the sender's leaf in the
ratchet tree is the same as the index of the leaf in the AS Tree used
to initialize the sender's ratchet.
Paragraph (version B):
Keys, nonces and secrets of ratchets are derived using
DeriveAppSecret.  The context in a given call consists of the index
of the sender's leaf in the ratchet tree and the current position in
the ratchet.  In particular, the index of the sender's leaf in the
ratchet tree is the same as the index of the leaf in the AS Tree used
to initialize the sender's ratchet.
Paragraph (version A):
The context used for the derivation of the "exported_value" MAY be
empty while each application SHOULD provide a unique label as an
input of the HKDF-Expand-Label for each use case.  This is to prevent
two exported outputs from being generated with the same values and
used for different functionalities.
Paragraph (version B):
The context used for the derivation of the "exported_value" MAY be
empty while each application SHOULD provide a unique label as an
input of the ExpandWithLabel for each use case.  This is to prevent
two exported outputs from being generated with the same values and
used for different functionalities.
Paragraph (version A):
The secret of any other node in the tree is derived from its parent's
secret using a call to Derive-App-Secret.
Paragraph (version B):
The secret of any other node in the tree is derived from its parent's
secret using a call to DeriveAppSecret.
Paragraph (version A):
The hash used for HKDF computations in MLS is the same hash used in
the HPKE KDF for the ciphersuite.