Use HKDF-Expand instead of PRG and PRF?

[blipp]

Could PRG(PRF(SK_t, "broad…")) also be HKDF-Expand(SK_t, "broad…", n*16)? Might be simpler than PRG+PRF with AES. With SHA-256 as underlying hash functions, HKDF-Expand still gives enough output to provide 512 16-byte chunks per day, i.e. a new EphID every 2.8 min.

(this is just for completeness a copy-paste of my tweet about this)

Related issues #57, #62, #72.

[nadimkobeissi]

+1, I'm just using HKDF when modeling this in Verifpal/ProVerif.

[kennypaterson]

We considered replacing the current construction with HKDF, but did not do so for the latest version of the whitepaper because of the relative costs of running AES and HMAC-SHA-256 inside HKDF-Expand. We plan to do further benchmarking, but note also that this issue is relevant only for the first option in the whitepaper, so is not high priority.