security: add KDF step when deriving symmetric key in mkem

[dobby-coder]

Tracked in security advisory: https://github.com/encryption4all/ibe/security/advisories/GHSA-236p-m8qr-cmjg

The mkem layer derives its AES-128-GCM encryption key by raw truncation of the KEM shared secret rather than applying a proper KDF. The fix involves applying HKDF-SHA256 (or switching to AES-256-GCM using the full output) with domain separation. See the advisory for full details.

[dobby-coder]

/dobby fix — In src/kem/mkem.rs, replace the raw prefix-truncation &kek.0[..KEY_SIZE] used to derive the AES-128-GCM key with a proper HKDF-SHA256 step: add hkdf and sha2 as dependencies, then derive the AES key via Hkdf::<Sha256>::new(None, &kek.0).expand(b"ibe-mkem-aes128gcm", &mut aes_key). This applies to both encapsulation (around line 99) and decapsulation (around line 150) sites in that file. Alternatively, switch from Aes128Gcm to Aes256Gcm and use the full 32-byte kek.0 directly, updating KEY_SIZE to 32.

[dobby-coder]

On it! I'll replace the raw key truncation with HKDF in mkem.rs, open a draft PR, and run a review/fix loop until it's clean.

[dobby-coder]

Dobby hit a rate limit mid-task and had to pause. Resets 02 Jul 2026, 05:29 CEST. I'll automatically resume where I left off — no work lost!

[dobby-coder]

Dobby hit a rate limit mid-task and had to pause. Resets 02 Jul 2026, 05:50 CEST. I'll automatically resume where I left off — no work lost!

[dobby-coder]

Reviewed PR #47 (fix/mkem-hkdf-key-derivation) — looks good to ship.

The HKDF-SHA256 key derivation is correct: both encaps and decaps derive the AES-128-GCM key from the full shared secret, feature gating is clean under default-features=false, builds pass for --all-features and wasm32 no-std, clippy/fmt are clean, and all 24 tests pass (including the 3 new HKDF unit tests).

The one thing missing was a CHANGELOG entry for this wire-incompatible crypto change — I added it inline (commit 3b7c410, under 0.3.0 Changed) rather than bouncing it back. Full sign-off here. PR is now out of draft and ready for merge.