[MLS] New Parent Hash

[Joel Alwen <[e-mail]>]

Hey people,

Just a quick heads up that Daniel, Marta and I put in a PR with a new version of
strong parent hash to prevent the attacks from the earlier thread. We tried to
make it as minimal as we could to help with deniability while still preventing
the attacks permitted by weak parent hashes.

In a nutshell, when computing parent_hash at node v with parent p and sibling w
we include
 - p's HPKE pubkey
 - p's parent_hash value and
 - HPKE pub keys in the resolution of w except for those belonging to leaves
unmerged at p.

As a sanity check, notice that as long as p's keys remain the same one can
always recompute the same parent_hash value at v as was initially computed by
the member that set p's keys. (In other words, new members can verify that the
stored parent_hash values match whats in the tree.) In particular, that's coz as
long as p's keys are unchanged so is the resolution of w. The only exception are
leaves being added as unmerged at w. But those leaves are also added as unmerged
at p so they are left out of the hash.

As for deniability, at least parent_hash only binds HPKE keys and nothing else
(like, say, credentials or signatures). Its the best we were able to come up
with for now...

- joël