Re: [MLS] Virtual Interim minutes

Richard Barnes <> Wed, 29 January 2020 23:36 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 8530512004E for <>; Wed, 29 Jan 2020 15:36:12 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.896
X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (2048-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id DaMtfRus_Ca1 for <>; Wed, 29 Jan 2020 15:36:09 -0800 (PST)
Received: from ( [IPv6:2607:f8b0:4864:20::72b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id F2D7F12003F for <>; Wed, 29 Jan 2020 15:36:08 -0800 (PST)
Received: by with SMTP id k6so1168206qki.5 for <>; Wed, 29 Jan 2020 15:36:08 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=ke9vbW6DGIqqIpaC2DT/q/6CLy10vdw+6yHk+7Z5X7E=; b=TE3uUeHmHtTQZrXrkkOeyYBAx59l9j9aYNIyU0cGAXceBi/O1fDFympglV8fnS7S/Z xn1/tmQGLPWH522BYaOW78PB4Hpk7fsqlbHI5oZnRiSaJXeelpSsMJVedOThyaZ7BqDM g1ex2YEfGEtcrmVL33bnb9Kao0aRGSayeCqSY3NqZgK/3Lvm3gZNm5quAB6x8XR/ieb2 tvqZn0UTH5F8X52XhDlZs6Kgg8UO29I1ctR4042R9EngoXS1G/mJXBwEMVuFeBn56JFi pBKsFqEwsBa7Q40Cr5cXRTLGI9WtVYVbZfJAeY4H9LDp+AxVbl4SBBfRJPEdiT4FxDHV KP/w==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=ke9vbW6DGIqqIpaC2DT/q/6CLy10vdw+6yHk+7Z5X7E=; b=SM92AUR2j9QthXG2JSPZA6rRrmtPuAcZWnuXPZTNwuWP8y4T2CDj0NX0b6JMq7CJZu KpX4gY1H+98EG+wuN4mSp2FzyLGCH7JyAaNpKr9xfX+V/LMzxUStOp0ruBKXfZFWVMO+ Yb7in9USSm3GZJ7SbHRG2CaVSpItr7YrBQuMtskCA44gDa+X01++6pCC/opwN/M135Km /inJNffUOUyzAyXclw3I3QjIYxgGFo6o1O0fHchAmOyIet55yYynDC5/HDMcHFoWSPko 4kj/TovZUNT93PuTUrZfcbRUMBu1nXX2pC/rG96JwTOJzKo87xHm0/8k1mwumbKfXkBq jYag==
X-Gm-Message-State: APjAAAXeY1HPQ+PvVGgzmLZW8u4hbyhHjTCaAGZhVdW047zSjHcm/e4y MV/1wp+bXpqUyMRQlwlWcfiGws6NefPoPnS2X2Z8pL3rbVC4nQ==
X-Google-Smtp-Source: APXvYqxKy/GADJxXEZoYHGrX+6VzWw9CL05TRUgz0FemJo47JMCDnH0Y4lzGvorwcqljZ1ndQRDGDZCGENI9+DKy9Yo=
X-Received: by 2002:a05:620a:102e:: with SMTP id a14mr2398758qkk.159.1580340967849; Wed, 29 Jan 2020 15:36:07 -0800 (PST)
MIME-Version: 1.0
References: <>
In-Reply-To: <>
From: Richard Barnes <>
Date: Wed, 29 Jan 2020 18:35:43 -0500
Message-ID: <>
To: Nick Sullivan <>
Cc: Messaging Layer Security WG <>
Content-Type: multipart/alternative; boundary="0000000000000351b5059d4fce2c"
Archived-At: <>
Subject: Re: [MLS] Virtual Interim minutes
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Messaging Layer Security <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Wed, 29 Jan 2020 23:36:13 -0000

Couple of additional notes:

#247 - Welcome confirmation and key derivation
This turned out to be obsolete, so I just closed it.

#246 - Bugfixes in ClientInitKey, Commit, and Welcome
This was mostly obsolete, so I refactored it to fix one typo and add an
extension for an application-provided CIK ID.  Then merged.

#281 - Extend the epoch with a commit hash
Thanks in part to some vigorous discussion at the interim, I've gotten over
my ardor for forking and closed this PR :)  I still think it will be
desirable to be able to have nonlinear history, but I also think it
requires some further analysis, and can be done as an extension.

As Brendan noted on the call, #287 depends on #286 and #286, so we should
probably merge those first...

#285 - Get rid of ignored proposals.
I had added "ignored" to the Commit message to allow the Committer to
indicate Proposals that they had received, but was not committing.  Brendan
makes a plausible case in the PR that this distinction is not worthwhile,
and this cleans it up.  Please speak up now if you have a concern /
objection to merging this PR.

#286 - Editorial: Unclear that Commits always include an Update/refreshes
the CIK for the committer.
I think this is ready to merge, with one minor clarification.

If I don't hear objections by Monday, I'll go ahead and commit #285, #286,
and #287.


On Wed, Jan 29, 2020 at 4:39 PM Nick Sullivan <nick=> wrote:

> Draft minutes from the productive first virtual interim posted below. If
> you find an issue, submit a PR to Github:
> Nick & Sean
> >>>
> Attendees:
> Joel Alwen, Richard Barnes, Raphael Robert, Britta Hale, Brendan
> McMillion, Nick Sullivan
> #247 - Welcome confirmation and key derivation
> * Fixes bugs RLB found in the last draft while implementing
> * OK to merge after rebase / conflict resolution
> #246 - Bugfixes in ClientInitKey, Commit, and Welcome
> * Derives the Welcome encryption key instead of generating fresh
> * ... under the general theory about not requiring freshness when not
> necessary
> * OK to merge after rebase / conflict resolution
> #283 - Use the same ratchet for Handshake and Application keys
> * There's no point to FS for Proposals because clients have to cache the
> plaintext anyway
> * Given that, the "flat derivation" approach should be fine
> * We should have separate keys per sender to it easier to avoid nonce
> collisions
> * RLB and RR to decide whether we should derive nonces on a hash ratchet
> or just use a counter
> #287 - Switch to signing strategy using one signature per leaf.
> * There was agreement among those on the call to proceed with this
> strategy (tree-hash-covers-parent-hash)
> * ... given the deniability concerns and unclear benefit of the
> alternative (parent-hash-covers-tree-hash)
> * If further considerations come to light from analysis, we can revisit
> later
> _______________________________________________
> MLS mailing list