Re: [MLS] protections for MLS "handshake" messages

[Eric Rescorla <[e-mail]>]

On Mon, Jul 23, 2018 at 8:57 AM, Benjamin Kaduk <[e-mail]> wrote:

> On Mon, Jul 23, 2018 at 08:49:01AM -0700, Eric Rescorla wrote:
> > On Mon, Jul 23, 2018 at 8:40 AM, Richard Barnes <[e-mail]> wrote:
> >
> > > 1. MLS needs to operate asynchronously, e.g., allowing a UserAdd / new
> > > device when all other members are offline
> > > 2. A new joiner is going to be able to authenticate the membership of
> the
> > > group before it transmits
> > >
> > > If we're going to enable both of those, then we're going to need
> whatever
> > > information is used for authentication to be cached somewhere that is
> > > reliably online.  And that information can't be encrypted, since you
> don't
> > > know anything a priori about what new device might show up.
> > >
> >
> > I think this is too nihilistic on too fronts:
> >
> > 1.Just because some group operations can't be hidden doesn't mean that
> none
> > of them can.
> > 2. I'm not sure why you are assuming that MLS needs to operate
> > asynchronously. Lots of systems operate on an "invite" model where one
> > group member invites others. Clearly that member can send the invite
> > information to the other member (though of course there are race
> conditions.
>
> We're chartered to develop key establishment and message protocols with
> properties including:
>
> o Asynchronicity - Keys can be established without any
> two participants being online at the same time
>

I should have said "user add". See above for how many protocols work.

-Ekr


>
> -Ben
>