Re: [MLS] Use Cases for avoiding Forward Secrecy

[Dennis Jackson <[e-mail]>]

> ​The cost of this shared state is far from trivial at the protocol
> level as both the sending and receiving device have to be in
> synchronization. What happens when Alice and Bob have a dozen
> devices? Then we have 144 sets of shared state.​

Phillip, it's clear you've read neither the MLS draft, nor the paper it
is based on. For example: one of the key contributions is a reduction in
the amount of shared state from O(n^2) to O(log n).

> If this group is not interested in open discussion, it might be in
> the wrong standards organization.
> Trying to shut down discussion of other requirements is a REALLY BAD
> predictor of success in IETF.
> Go talk to the DANE folk and see how that worked for them. 

The discussion on PFS has been done to death, both on the TLS mailing
list and in numerous other places and I would hate to see us repeat it
for little gain. In the end, TLS 1.3 mandates that PFS be used in
every connection. I find it hard to imagine that MLS will aspire 
to a weaker security goal than TLS, but as you say, it is for the
group to decide. 

On Wed, 28 Feb 2018 18:03:31 -0500
Phillip Hallam-Baker <[e-mail]> wrote:

> On Wed, Feb 28, 2018 at 5:28 PM, Dennis Jackson
> <[e-mail]> wrote:
> 
> > > If however we are working at the message layer, we will often
> > > want to support an asynchronous mode in which one party sends
> > > some data and another picks it up later. That does not prevent us
> > > working end to end but it does prevent us using PFS.
> >
> > This is incorrect. You may want to review the design of Signal, or
> > indeed the current MLS draft.
> 
> 
> ​No it is completely correct. The P in PFS stands for Perfect .
> 
> If Alice creates a message for Bob using only her knowledge of Bob's
> public key then it is not going to be PFS because a compromise of
> Bob's private key is a breach.
> 
> What Signal is doing is sending messages based on Bob's key plus
> state from previous communications that Alice and Bob have stored.
> Now that is providing some form of Forward Secrecy but only a
> marketing person would claim it was 'Perfect'.
> 
> ​The cost of this shared state is far from trivial at the protocol
> level as both the sending and receiving device have to be in
> synchronization. What happens when Alice and Bob have a dozen
> devices? Then we have 144 sets of shared state.​