fix: derive mkem AES key via HKDF-SHA256 instead of raw truncation

The mkem layer derived its AES-128-GCM key by truncating the KEM shared
secret (`&kek.0[..KEY_SIZE]`) rather than applying a KDF. Replace this
with an HKDF-SHA256 expansion using a domain-separation label
(`ibe-mkem-aes128gcm`) at both the encapsulation and decapsulation
sites, via a shared `derive_aead` helper.

Adds `hkdf` and `sha2` as optional dependencies gated behind the `mkem`
feature. Includes unit tests covering determinism, divergence from raw
truncation, and dependence on the full shared secret.

Refs GHSA-236p-m8qr-cmjg, closes #44

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: dobby-coder[bot]

Cargo.toml

@@ -24,6 +24,8 @@ pg-curve = { version = "0.2.0", features = [
 subtle = { version = "2.4.1", default-features = false }
 tiny-keccak = { version = "2.0.2", features = ["sha3", "shake"] }
 aes-gcm = { version = "0.10", optional = true }
+hkdf = { version = "0.12", default-features = false, optional = true }
+sha2 = { version = "0.10", default-features = false, optional = true }
 
 [target.wasm32-unknown-unknown.dependencies]
 getrandom = { version = "0.2", features = ["js"] }
@@ -41,7 +43,7 @@ cgwkv = []
 kv1 = []
 waters = []
 waters_naccache = []
-mkem = ["aes-gcm"]
+mkem = ["aes-gcm", "hkdf", "sha2"]
 
 [lib]
 bench = false

src/kem/mkem.rs

@@ -42,6 +42,8 @@ use subtle::CtOption;
 
 use aes_gcm::aead::{Nonce, Tag};
 use aes_gcm::{AeadInPlace, Aes128Gcm, KeyInit};
+use hkdf::Hkdf;
+use sha2::Sha256;
 
 #[cfg(feature = "cgwfo")]
 use crate::kem::cgw_fo::CGWFO;
@@ -56,6 +58,27 @@ const TAG_SIZE: usize = 16;
 const NONCE_SIZE: usize = 12;
 const KEY_SIZE: usize = 16;
 
+/// Domain-separation label for the HKDF-SHA256 expansion that turns the KEM
+/// shared secret into the AES-128-GCM key.
+const HKDF_INFO: &[u8] = b"ibe-mkem-aes128gcm";
+
+/// Derives the AES-128-GCM key bytes from a KEM shared secret using
+/// HKDF-SHA256 with domain separation, rather than raw truncation of the
+/// shared secret.
+fn derive_aead_key(kek: &SharedSecret) -> [u8; KEY_SIZE] {
+    let mut aes_key = [0u8; KEY_SIZE];
+    Hkdf::<Sha256>::new(None, &kek.0)
+        .expand(HKDF_INFO, &mut aes_key)
+        .expect("KEY_SIZE is a valid HKDF-SHA256 output length");
+
+    aes_key
+}
+
+/// Builds the AES-128-GCM instance keyed with the HKDF-derived key.
+fn derive_aead(kek: &SharedSecret) -> Aes128Gcm {
+    Aes128Gcm::new_from_slice(&derive_aead_key(kek)).expect("aes_key has the correct length")
+}
+
 impl SharedSecret {
     /// Sample random shared secret.
     fn random<R: Rng + CryptoRng>(r: &mut R) -> Self {
@@ -96,7 +119,7 @@ where
 
         let (ct_asymm, kek) = <K as IBKEM>::encaps(self.pk, id, self.rng);
 
-        let aead = Aes128Gcm::new_from_slice(&kek.0[..KEY_SIZE]).unwrap();
+        let aead = derive_aead(&kek);
         let nonce_bytes = self.rng.gen::<[u8; NONCE_SIZE]>();
         let nonce = Nonce::<Aes128Gcm>::from_slice(&nonce_bytes);
 
@@ -147,7 +170,7 @@ pub trait MultiRecipient: IBKEM {
         ct: &Ciphertext<Self>,
     ) -> Result<SharedSecret, Error> {
         let kek = <Self as IBKEM>::decaps(mpk, usk, &ct.ct_asymm)?;
-        let aead = Aes128Gcm::new_from_slice(&kek.0[..KEY_SIZE]).unwrap();
+        let aead = derive_aead(&kek);
         let mut shared_key = ct.ct_symm;
         aead.decrypt_in_place_detached(&ct.nonce, b"", &mut shared_key, &ct.tag)
             .map_err(|_e| Error)?;
@@ -206,3 +229,42 @@ impl_mkemct_compress!(CGWFO);
 
 #[cfg(feature = "kv1")]
 impl_mkemct_compress!(KV1);
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn derive_aead_key_is_deterministic() {
+        let kek = SharedSecret([7u8; SS_BYTES]);
+        assert_eq!(derive_aead_key(&kek), derive_aead_key(&kek));
+    }
+
+    #[test]
+    fn derive_aead_key_differs_from_raw_truncation() {
+        // The vulnerability being fixed: the key used to be `&kek.0[..KEY_SIZE]`.
+        // HKDF-SHA256 must mix the whole secret, so the derived key should not
+        // equal the raw prefix of the shared secret.
+        let kek = SharedSecret([0xABu8; SS_BYTES]);
+        assert_ne!(&derive_aead_key(&kek)[..], &kek.0[..KEY_SIZE]);
+    }
+
+    #[test]
+    fn derive_aead_key_depends_on_full_secret() {
+        // Two secrets sharing the same first KEY_SIZE bytes but differing in the
+        // tail would collide under raw truncation; HKDF must keep them distinct.
+        let mut a = [0u8; SS_BYTES];
+        let mut b = [0u8; SS_BYTES];
+        for (i, (x, y)) in a.iter_mut().zip(b.iter_mut()).enumerate() {
+            *x = i as u8;
+            *y = i as u8;
+        }
+        b[SS_BYTES - 1] ^= 0xFF;
+
+        assert_eq!(&a[..KEY_SIZE], &b[..KEY_SIZE]);
+        assert_ne!(
+            derive_aead_key(&SharedSecret(a)),
+            derive_aead_key(&SharedSecret(b))
+        );
+    }
+}