diff --git a/draft-dijkhuis-cfrg-hdkeys-00/draft-dijkhuis-cfrg-hdkeys.html b/feat/export/draft-dijkhuis-cfrg-hdkeys.html
similarity index 97%
rename from draft-dijkhuis-cfrg-hdkeys-00/draft-dijkhuis-cfrg-hdkeys.html
rename to feat/export/draft-dijkhuis-cfrg-hdkeys.html
index da1596c..dff0d1d 100644
--- a/draft-dijkhuis-cfrg-hdkeys-00/draft-dijkhuis-cfrg-hdkeys.html
+++ b/feat/export/draft-dijkhuis-cfrg-hdkeys.html
@@ -9,18 +9,18 @@
 <meta content="
        Hierarchical Deterministic Keys enables managing large sets of keys bound to a secure cryptographic device that protects a single key. This enables the development of secure digital identity wallets providing many one-time-use public keys. 
     " name="description">
-<meta content="xml2rfc 3.22.0" name="generator">
+<meta content="xml2rfc 3.23.1" name="generator">
 <meta content="KDF" name="keyword">
 <meta content="draft-dijkhuis-cfrg-hdkeys-latest" name="ietf.draft">
 <!-- Generator version information:
-  xml2rfc 3.22.0
-    Python 3.12.3
+  xml2rfc 3.23.1
+    Python 3.12.6
     ConfigArgParse 1.7
-    google-i18n-address 3.1.0
+    google-i18n-address 3.1.1
     intervaltree 3.1.0
     Jinja2 3.1.4
     lxml 4.9.4
-    platformdirs 4.2.2
+    platformdirs 4.3.6
     pycountry 22.3.5
     PyYAML 6.0.1
     requests 2.32.3
@@ -1024,11 +1024,11 @@
 <thead><tr>
 <td class="left">Internet-Draft</td>
 <td class="center">HDK</td>
-<td class="right">August 2024</td>
+<td class="right">September 2024</td>
 </tr></thead>
 <tfoot><tr>
 <td class="left">Dijkhuis</td>
-<td class="center">Expires 24 February 2025</td>
+<td class="center">Expires 29 March 2025</td>
 <td class="right">[Page]</td>
 </tr></tfoot>
 </table>
@@ -1041,12 +1041,12 @@
 <dd class="internet-draft">draft-dijkhuis-cfrg-hdkeys-latest</dd>
 <dt class="label-published">Published:</dt>
 <dd class="published">
-<time datetime="2024-08-23" class="published">23 August 2024</time>
+<time datetime="2024-09-25" class="published">25 September 2024</time>
     </dd>
 <dt class="label-intended-status">Intended Status:</dt>
 <dd class="intended-status">Informational</dd>
 <dt class="label-expires">Expires:</dt>
-<dd class="expires"><time datetime="2025-02-24">24 February 2025</time></dd>
+<dd class="expires"><time datetime="2025-03-29">29 March 2025</time></dd>
 <dt class="label-authors">Author:</dt>
 <dd class="authors">
 <div class="author">
@@ -1091,7 +1091,7 @@ <h2 id="name-status-of-this-memo">
         time. It is inappropriate to use Internet-Drafts as reference
         material or to cite them other than as "work in progress."<a href="#section-boilerplate.1-3" class="pilcrow">¶</a></p>
 <p id="section-boilerplate.1-4">
-        This Internet-Draft will expire on 24 February 2025.<a href="#section-boilerplate.1-4" class="pilcrow">¶</a></p>
+        This Internet-Draft will expire on 29 March 2025.<a href="#section-boilerplate.1-4" class="pilcrow">¶</a></p>
 </section>
 </div>
 <div id="copyright">
@@ -1159,6 +1159,9 @@ <h2 id="name-copyright-notice">
 </li>
               <li class="compact toc ulBare ulEmpty" id="section-toc.1-1.2.2.7">
                 <p id="section-toc.1-1.2.2.7.1"><a href="#section-2.7" class="auto internal xref">2.7</a>.  <a href="#name-the-hdk-authenticate-functi" class="internal xref">The HDK-Authenticate function</a></p>
+</li>
+              <li class="compact toc ulBare ulEmpty" id="section-toc.1-1.2.2.8">
+                <p id="section-toc.1-1.2.2.8.1"><a href="#section-2.8" class="auto internal xref">2.8</a>.  <a href="#name-the-hdk-export-blinding-fac" class="internal xref">The HDK-Export-Blinding-Factor function</a></p>
 </li>
             </ul>
 </li>
@@ -1567,6 +1570,32 @@ <h3 id="name-the-hdk-authenticate-functi">
 <p id="section-2.7-4">A HDK instantiation <span class="bcp14">MUST</span> define HDK-Authenticate such that the <code>device_data</code> can be verified using the public key in the same HDK as <code>sk_hdk</code>. The reader does not need to know that HDK was applied: the public key will look like any other public key used for proofs of possession.<a href="#section-2.7-4" class="pilcrow">¶</a></p>
 </section>
 </div>
+<div id="the-hdk-export-blinding-factor-function">
+<section id="section-2.8">
+        <h3 id="name-the-hdk-export-blinding-fac">
+<a href="#section-2.8" class="section-number selfRef">2.8. </a><a href="#name-the-hdk-export-blinding-fac" class="section-name selfRef">The HDK-Export-Blinding-Factor function</a>
+        </h3>
+<p id="section-2.8-1">When presenting multiple documents, a reader could require a proof that multiple keys are associated to a single device. Several protocols for a cryptographic proof of association are possible.<a href="#section-2.8-1" class="pilcrow">¶</a></p>
+<p id="section-2.8-2">For example, a solution instance could prove that two elliptic curve keys <code>B1 = [bf1]D</code> and <code>B2 = [bf2]D</code>, where <code>bf1</code> and <code>bf2</code> are multiplicative blinding factors for a common device public key <code>D</code>, are associated using a zero-knowledge protocol. In this protocol, the solution instance proves that they know the discrete logarithm of <code>B2 = [bf2/bf1]B1</code> with respect to generator <code>B1</code>.<a href="#section-2.8-2" class="pilcrow">¶</a></p>
+<p id="section-2.8-3">The construction of proof of association protocols requires availability to the prover of the blinding factors. The following function enables exporting these blinding factors.<a href="#section-2.8-3" class="pilcrow">¶</a></p>
+<div class="alignLeft art-text artwork" id="section-2.8-4">
+<pre>
+Inputs:
+- pk, an HDK public key.
+- sk, an HDK private key.
+- salt, an HDK salt which is a string of Ns bytes.
+
+Outputs:
+- bf, an HDK private key which is used as a blinding factor.
+
+def HDK-Export-Blinding-Factor((pk, sk, salt)):
+    bf = sk
+    return bf
+</pre><a href="#section-2.8-4" class="pilcrow">¶</a>
+</div>
+<p id="section-2.8-5">Implementations <span class="bcp14">SHOULD</span> use a plausibly deniable proof of association protocol to ensure that the interactive presentation does not accidentally generate evidence that is potentially non-repudiable.<a href="#section-2.8-5" class="pilcrow">¶</a></p>
+</section>
+</div>
 </section>
 </div>
 <div id="generic-hdk-instantiations">
diff --git a/draft-dijkhuis-cfrg-hdkeys-00/draft-dijkhuis-cfrg-hdkeys.txt b/feat/export/draft-dijkhuis-cfrg-hdkeys.txt
similarity index 95%
rename from draft-dijkhuis-cfrg-hdkeys-00/draft-dijkhuis-cfrg-hdkeys.txt
rename to feat/export/draft-dijkhuis-cfrg-hdkeys.txt
index 984baa1..f52c98e 100644
--- a/draft-dijkhuis-cfrg-hdkeys-00/draft-dijkhuis-cfrg-hdkeys.txt
+++ b/feat/export/draft-dijkhuis-cfrg-hdkeys.txt
@@ -4,8 +4,8 @@
 
 Crypto Forum                                         S. Q. Dijkhuis, Ed.
 Internet-Draft                                                Cleverbase
-Intended status: Informational                            23 August 2024
-Expires: 24 February 2025
+Intended status: Informational                         25 September 2024
+Expires: 29 March 2025
 
 
                     Hierarchical Deterministic Keys
@@ -43,7 +43,7 @@ Status of This Memo
    time.  It is inappropriate to use Internet-Drafts as reference
    material or to cite them other than as "work in progress."
 
-   This Internet-Draft will expire on 24 February 2025.
+   This Internet-Draft will expire on 29 March 2025.
 
 Copyright Notice
 
@@ -71,6 +71,7 @@ Table of Contents
      2.5.  The HDK-Seed-Remote function
      2.6.  The HDK-Derive-Remote function
      2.7.  The HDK-Authenticate function
+     2.8.  The HDK-Export-Blinding-Factor function
    3.  Generic HDK instantiations
      3.1.  Using elliptic curves
      3.2.  Using ECDH message authentication codes for proof of
@@ -439,6 +440,39 @@ Table of Contents
    public key will look like any other public key used for proofs of
    possession.
 
+2.8.  The HDK-Export-Blinding-Factor function
+
+   When presenting multiple documents, a reader could require a proof
+   that multiple keys are associated to a single device.  Several
+   protocols for a cryptographic proof of association are possible.
+
+   For example, a solution instance could prove that two elliptic curve
+   keys B1 = [bf1]D and B2 = [bf2]D, where bf1 and bf2 are
+   multiplicative blinding factors for a common device public key D, are
+   associated using a zero-knowledge protocol.  In this protocol, the
+   solution instance proves that they know the discrete logarithm of B2
+   = [bf2/bf1]B1 with respect to generator B1.
+
+   The construction of proof of association protocols requires
+   availability to the prover of the blinding factors.  The following
+   function enables exporting these blinding factors.
+
+   Inputs:
+   - pk, an HDK public key.
+   - sk, an HDK private key.
+   - salt, an HDK salt which is a string of Ns bytes.
+
+   Outputs:
+   - bf, an HDK private key which is used as a blinding factor.
+
+   def HDK-Export-Blinding-Factor((pk, sk, salt)):
+       bf = sk
+       return bf
+
+   Implementations SHOULD use a plausibly deniable proof of association
+   protocol to ensure that the interactive presentation does not
+   accidentally generate evidence that is potentially non-repudiable.
+
 3.  Generic HDK instantiations
 
 3.1.  Using elliptic curves
diff --git a/draft-dijkhuis-cfrg-hdkeys-00/index.html b/feat/export/index.html
similarity index 81%
rename from draft-dijkhuis-cfrg-hdkeys-00/index.html
rename to feat/export/index.html
index a7206f4..dd16e49 100644
--- a/draft-dijkhuis-cfrg-hdkeys-00/index.html
+++ b/feat/export/index.html
@@ -1,7 +1,7 @@
 <!DOCTYPE html>
 <html>
   <head>
-    <title>sander/hierarchical-deterministic-keys draft-dijkhuis-cfrg-hdkeys-00 preview</title>
+    <title>sander/hierarchical-deterministic-keys feat/export preview</title>
     <meta name="viewport" content="initial-scale=1.0">
     <style type="text/css">/*<![CDATA[*/
       body { font-family: "Helvetica Neue","Open Sans", Helvetica, Calibri,sans-serif; }
@@ -13,8 +13,8 @@
     /*]]>*/</style>
   </head>
   <body>
-    <h1>Editor's drafts for draft-dijkhuis-cfrg-hdkeys-00 branch of <a href="https://github.com/sander/hierarchical-deterministic-keys/tree/draft-dijkhuis-cfrg-hdkeys-00">sander/hierarchical-deterministic-keys</a></h1>
-    <table id="branch-draft-dijkhuis-cfrg-hdkeys-00">
+    <h1>Editor's drafts for feat/export branch of <a href="https://github.com/sander/hierarchical-deterministic-keys/tree/feat/export">sander/hierarchical-deterministic-keys</a></h1>
+    <table id="branch-feat/export">
       <tr>
         <td><a href="./draft-dijkhuis-cfrg-hdkeys.html" class="html draft-dijkhuis-cfrg-hdkeys" title="Hierarchical Deterministic Keys (HTML)">HDK</a></td>
         <td><a href="./draft-dijkhuis-cfrg-hdkeys.txt" class="txt draft-dijkhuis-cfrg-hdkeys" title="Hierarchical Deterministic Keys (Text)">plain text</a></td>
diff --git a/index.html b/index.html
index 565faf4..e77d275 100644
--- a/index.html
+++ b/index.html
@@ -49,12 +49,12 @@ <h2>Preview for branch <a href="feat/distributed-wsca">feat/distributed-wsca</a>
         <td><a href="https://author-tools.ietf.org/api/iddiff?url_1=https://sander.github.io/hierarchical-deterministic-keys/draft-dijkhuis-cfrg-hdkeys.txt&amp;url_2=https://sander.github.io/hierarchical-deterministic-keys/feat/distributed-wsca/draft-dijkhuis-cfrg-hdkeys.txt" class="diff draft-dijkhuis-cfrg-hdkeys">diff with main</a></td>
       </tr>
     </table>
-    <h2>Preview for branch <a href="draft-dijkhuis-cfrg-hdkeys-00">draft-dijkhuis-cfrg-hdkeys-00</a></h2>
-    <table id="branch-draft-dijkhuis-cfrg-hdkeys-00">
+    <h2>Preview for branch <a href="feat/export">feat/export</a></h2>
+    <table id="branch-feat/export">
       <tr>
-        <td><a href="draft-dijkhuis-cfrg-hdkeys-00/draft-dijkhuis-cfrg-hdkeys.html" class="html draft-dijkhuis-cfrg-hdkeys" title="Hierarchical Deterministic Keys (HTML)">HDK</a></td>
-        <td><a href="draft-dijkhuis-cfrg-hdkeys-00/draft-dijkhuis-cfrg-hdkeys.txt" class="txt draft-dijkhuis-cfrg-hdkeys" title="Hierarchical Deterministic Keys (Text)">plain text</a></td>
-        <td>same as main</td>
+        <td><a href="feat/export/draft-dijkhuis-cfrg-hdkeys.html" class="html draft-dijkhuis-cfrg-hdkeys" title="Hierarchical Deterministic Keys (HTML)">HDK</a></td>
+        <td><a href="feat/export/draft-dijkhuis-cfrg-hdkeys.txt" class="txt draft-dijkhuis-cfrg-hdkeys" title="Hierarchical Deterministic Keys (Text)">plain text</a></td>
+        <td><a href="https://author-tools.ietf.org/api/iddiff?url_1=https://sander.github.io/hierarchical-deterministic-keys/draft-dijkhuis-cfrg-hdkeys.txt&amp;url_2=https://sander.github.io/hierarchical-deterministic-keys/feat/export/draft-dijkhuis-cfrg-hdkeys.txt" class="diff draft-dijkhuis-cfrg-hdkeys">diff with main</a></td>
       </tr>
     </table>
     <script>