[MLS] PBC in MLS

[Marek Jankowski <[e-mail]>]

Hi all,

I have only briefly read through the previous MLS discussions, so please
forgive me if it had been discussed before.

Lately there has been significant amount of research and standardization
effort in the area of pairings (I-D boneh, I-D yonezawa). The schemes, some
of which are already deployed in the industry (Cloudflare, Intel), offer
interesting cryptographic primitives with somewhat surprisingly small
ciphertext length.

One of the drawbacks I identified in the current MLS proposal is the log(n)
factor each user pays in bandwidth for every ADD/DELETE/UPDATE message. It
is especially significant in groups with many members, which is a
requirement for any MLS solution. I wonder if any of the primitives PBC
offers (O(1) ciphertext length IBBE, 3PDH) may reduce the bandwidth usage
for large groups.

I would be happy to hear any of the folks' ideas and thoughts regarding
those schemes and their potential uses for MLS.

Thank you,
Marek.