Re: [MLS] Artart early review of draft-ietf-mls-protocol-16

[Richard Barnes <[e-mail]>]

Hey Rich,

Thanks for the review.  I have filed #749:

https://github.com/mlswg/mls-protocol/pull/749

A few responses inline...

On Wed, Sep 28, 2022 at 3:18 PM Rich Salz via Datatracker <[e-mail]>
wrote:

> Abstract:
> Nicely describes the problem. Is 'forward secrecy and post-compromise
> security'
> redundant? If not, there should be definitions in the draft for both terms
> and
> perhaps a forward link toe the terminology section.
>

As usual, a fully rigorous definition is outside the scope of an IETF
spec.  I added some text to the security considerations and a forward
pointer from Terminology.


> Introduction.
> "pairwise broadcast of individual messages" seems to go to far for
> terseness to
> make the sentence grammatical.


Good point, broke up the sentence.


> The section on common strategy should have a
> reference or two to implementations.


Signal is one implementation, so hopefully that suffices.  But this is one
of those things that is commonly done and poorly documented, so there
aren't great references otherwise.


> And do you mean "unilaterally broadcast
> *A*symmetric keys"  Or is the common technique to allow everyone to
> impersonate
> anyone?
>

Nope, symmetric keys.  With sender keys, there's no protection against
impersonation within a group.  IIUC, somewhat by design, because
deniability is more important.



> Sec 2, Terminology.
> Alphabetical order please.
>

I think it's clearer to keep things in a conceptual order.


> Maybe mention that MSLPlaintext, MLSCiphertext are message formats
> described in
> section 4.1; I wondered why they didn't appear in the terminology.


Added a forward reference.


> And when I
> searched forward to find where they are defined, I noticed that elsewhere
> they
> are rendered as `_MLSPlaintext_` for example, and here the underscores
> aren't
> present.  Consistency is a virtue.


The underscores are for emphasis when concepts are introduced, and not used
afterward.


> The last paragraph starts by saying "keys
> and secrets are used interchangeably" which is contradicted by the last
> sentence.
>

"Typically"!  The point is that they mean the same thing, but we use
different words to suggest slightly different roles.


Sec 2.1.2

The example vector should be
> "StructWithVector" not plural, right?
>

No, there are two vectors there.  One with a fixed-size length and one with
a variable-size length.


Sec 4.2 is very useful and have a nice use of the railroad diagrams. The
> section title should be plural tho. "Executions"


It's a single execution, shown in several steps.


> Is there any guidance to be
> offered on access control policies?  How does A know whether or not Z can
> remove B? Are messages NAK'd or ignored or something else? I guess a
> forward
> link to 6.3 makes sense.
>

This is more an issue for the architecture, see, e.g.:

https://github.com/mlswg/mls-architecture/blob/main/draft-ietf-mls-architecture.md#access-control


I skimmed sec 7 and 8.  The end of 8.4 'where lp and np[i] represent"
> confused
> me as I don't see those notations in the diagram that follows.
>

Good catch.  Those notations were removed in an earlier revision.

Thanks,
--Richard