How do two parties agree on a key with CryptoKit, why must the shared secret go through HKDF, and what does HPKE add?

Predict first

Do both sides derive the same key, and does HPKE enforce order?

import Foundation
import CryptoKit

let a = Curve25519.KeyAgreement.PrivateKey(), b = Curve25519.KeyAgreement.PrivateKey()
let sa = try a.sharedSecretFromKeyAgreement(with: b.publicKey)
let sb = try b.sharedSecretFromKeyAgreement(with: a.publicKey)
print("shared secrets equal:", sa == sb)
let salt = Data("salt".utf8)
let enc1 = sa.hkdfDerivedSymmetricKey(using: SHA256.self, salt: salt, sharedInfo: Data("encrypt".utf8), outputByteCount: 32)
let enc2 = sb.hkdfDerivedSymmetricKey(using: SHA256.self, salt: salt, sharedInfo: Data("encrypt".utf8), outputByteCount: 32)
let mac = sa.hkdfDerivedSymmetricKey(using: SHA256.self, salt: salt, sharedInfo: Data("mac".utf8), outputByteCount: 32)
print("both sides derive the same key:", enc1 == enc2, "| other label gives another key:", enc1 != mac)
let ikm = SymmetricKey(data: Data(repeating: 0x0b, count: 22))
let okm = HKDF<SHA256>.deriveKey(inputKeyMaterial: ikm, salt: Data((0...12).map { UInt8($0) }), info: Data((0xf0...0xf9).map { UInt8($0) }), outputByteCount: 42)
print("RFC 5869 vector 1:", okm.withUnsafeBytes { $0.map { String(format: "%02x", $0) }.joined() })
let suite = HPKE.Ciphersuite.Curve25519_SHA256_ChachaPoly
let recipient = Curve25519.KeyAgreement.PrivateKey()
var sender = try HPKE.Sender(recipientKey: recipient.publicKey, ciphersuite: suite, info: Data("ctx".utf8))
let c1 = try sender.seal(Data("hello".utf8), authenticating: Data("aad".utf8))
let c2 = try sender.seal(Data("hello".utf8), authenticating: Data("aad".utf8))
var r = try HPKE.Recipient(privateKey: recipient, ciphersuite: suite, info: Data("ctx".utf8), encapsulatedKey: sender.encapsulatedKey)
print("hpke:", String(decoding: try r.open(c1, authenticating: Data("aad".utf8)), as: UTF8.self), "| same plaintext twice differs:", c1 != c2)
var late = try HPKE.Recipient(privateKey: recipient, ciphersuite: suite, info: Data("ctx".utf8), encapsulatedKey: sender.encapsulatedKey)
do { _ = try late.open(c2, authenticating: Data("aad".utf8)) } catch { print("second message first:", error) }

• shared secrets equal: true / both sides derive the same key: true | other label gives another key: true / RFC 5869 vector 1: 3cb25f25faacd57a90434f64d0362f2a2d2d0a90cf1a5a4c5db02d56ecc4c5bf34007208d5b887185865 / hpke: hello | same plaintext twice differs: true / second message first: authenticationFailure
• shared secrets equal: false / second message first: opened
• both sides derive the same key: false