Function deriveMediaEncryptionKey

Derives the per-file encryption key for an encrypted-media-v1 attachment.

media_secret = MLS-Exporter("marmot", "encrypted-media", 32) at source_epoch
file_key     = HKDF-Expand(media_secret,
                 "encrypted-media-v1" || 0x00 || plaintext_sha256_bytes ||
                 0x00 || media_type || 0x00 || filename || 0x00 || "key", 32)
Copy

HKDF is HKDF-SHA256 with media_secret used directly as the PRK (Expand only, no Extract). The key is deterministic for a given source epoch + file.

The source epoch is the MLS epoch of the application message that carried the attachment. The caller MUST pass the ClientState for that epoch: on send, the current state; on receive, the retained state for the message's source epoch (see features/encrypted-media.md — Key Derivation).