Re: [MLS] Encryption vs Masking for the sender information

[Richard Barnes <[e-mail]>]

On Thu, May 2, 2019 at 5:05 AM Benjamin Beurdouche <
[e-mail]> wrote:

>
> > On May 2, 2019, at 10:02 AM, Karthikeyan Bhargavan <
> [e-mail]> wrote:
> >
> > Looking at: https://github.com/mlswg/mls-protocol/pull/155
> >
> > I see that there is a change in metadata encryption:
> >
> >>      "sample = ciphertext[:Hash.length]
> >>      mask = HMAC(sender_data_secret, sample)[:8]
> >>      encrypted_sender_data = sender_data ^ mask
> >>      ~~~~~
> >>
> >>      This approach is similar to the one used for protection of header
> >>      information in QUIC (see Section 5.4 of {{?I-D.ietf-quic-tls}}).
> >>      Note that the sender data values are authenticated by the AEAD
> >>      and the signature, while the masked_sender_data is not and only
> >>      benefit from passive security because it depends on the ciphertext
> >
> > I disagree with this change, because it is too early to put in
> optimizations,
> > especially those that rely on non-standard cryptographic constructions.
> > I would prefer that we go back to using plain AEAD for the sender_data,
> > and that we add this kind of optimization once we have a proof that it
> is secure.
>
> Using AEAD was in my original PR (#131), but multiple PRs have been
> opened and merged together over the last few weeks leading to this state.
> I have operationnal control over #155 right now and it is not merged, so
> I would be completely fine with going back to use AEAD for now as it
> provides better protection against active adversaries anyway...
>

We published draft-05 today with AEAD instead of masking.  I have a pretty
strong preference for masking, though, because AEAD imposes a lot of
overhead.  Maybe we could discuss this at the interim?

--Richard