[MLS] Authentication

[Richard Barnes <[e-mail]>]

Hey all,

I've been stewing about authentication for a little while, and I think I've
gotten to a point where I have coherent-enough thoughts to share with the
group.  (Though by no means final)  The attached PDF has some slightly
stream-of-consciousness thoughts about authentication for MLS, but it ends
up with (1) some crypto protocols with a degree of validation and (2) a
loose proposal and some questions for the WG.

Leaving the crypto details and protocol details for the PDF, the questions
for the WG are as follows:

1. Is there any reason to prefer one of the two constructions in the
document over the other?

2. The protocol enables agreement on a "roster" of participants.  Should
that roster include only identities of participants, or also their public
keys?

3. Can we rely on clients keeping around a copy of the roster, so that they
can then use it to authenticate future messages?

4. Should the roster be distributed by the MLS protocol, or should MLS just
provide a pointer?

5. Other than the roster, what information should we enforce group
agreement on?

The doc has some thoughts on the arguments on either side of all of these
questions.

The next step here is to generate a pull request that makes a concrete
proposal.  If folks have thoughts about the overall plausibility of the
analysis here, or thoughts on the design trade-offs highlighted above, that
would be helpful as I work on fleshing this out.  Hope to have a PR in
flight in time for the interim.

Thanks,
--Richard