Note about BLAKE2s-XOF as a KDF

diff --git a/doc/proto.texi b/doc/proto.texi
index a1af4d43a52e65b4a9eb9b6e30a2a7e718c84f2164a7fe8e68bd90e003641b61..dc7c3d2a88535dd060a9259b8c2c14634d1ca903a586d0e8d136dbe49bb866d3 100644 (file)
--- a/doc/proto.texi
+++ b/doc/proto.texi
@@ -11,9 +11,10 @@ participant) and 24-bit big-endian packet counter. Reordered packets are
 dropped. 24-bit counter is long enough for very long talk sessions.
 
 Each packet is encrypted with ChaCha20 and authenticated with SipHash24.
 dropped. 24-bit counter is long enough for very long talk sessions.
 
 Each packet is encrypted with ChaCha20 and authenticated with SipHash24.

-The keys are generated during the handshake procedure with the server
-and is shared among the other participants. The stream identifier
-together with the packet counter is used as a nonce.
+Their keys are generated from BLAKE2s-XOF, which is fed with completed
+handshake's binding value. Then they are shared among the other
+participants. The stream identifier together with the packet counter is
+used as a nonce.

 
 It is tuned for 24Kbps bandwidth. But remember that it has additional 8B
 of MAC tag, 4B VoRS, 8B UDP and 40B IPv6 headers.
 
 It is tuned for 24Kbps bandwidth. But remember that it has additional 8B
 of MAC tag, 4B VoRS, 8B UDP and 40B IPv6 headers.