Re: [MLS] Re-randomized TreeKEM

Benjamin Beurdouche <benjamin.beurdouche@inria.fr> Mon, 21 October 2019 12:28 UTC

Return-Path: <benjamin.beurdouche@inria.fr>
X-Original-To: mls@ietfa.amsl.com
Delivered-To: mls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 92590120099 for <mls@ietfa.amsl.com>; Mon, 21 Oct 2019 05:28:06 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -6.899
X-Spam-Level:
X-Spam-Status: No, score=-6.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id inEnQwpXoOQF for <mls@ietfa.amsl.com>; Mon, 21 Oct 2019 05:28:04 -0700 (PDT)
Received: from mail2-relais-roc.national.inria.fr (mail2-relais-roc.national.inria.fr [192.134.164.83]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6436112004D for <mls@ietf.org>; Mon, 21 Oct 2019 05:28:04 -0700 (PDT)
X-IronPort-AV: E=Sophos;i="5.67,323,1566856800"; d="scan'208,217";a="407220125"
Received: from unknown (HELO [172.20.10.9]) ([37.170.227.202]) by mail2-relais-roc.national.inria.fr with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 21 Oct 2019 14:28:02 +0200
From: Benjamin Beurdouche <benjamin.beurdouche@inria.fr>
Message-Id: <53173BBC-7339-47C0-98A8-FCE6A30E3D78@inria.fr>
Content-Type: multipart/alternative; boundary="Apple-Mail=_1B97420D-3A11-4D00-AD6D-7CBFEFE31E0A"
Mime-Version: 1.0 (Mac OS X Mail 13.0 \(3594.4.19\))
Date: Mon, 21 Oct 2019 14:28:01 +0200
In-Reply-To: <dbe0eb1a-7a6a-4973-0951-7b6dd6f74a56@datashrine.de>
Cc: ML Messaging Layer Security <mls@ietf.org>
To: Konrad Kohbrok <konrad.kohbrok@datashrine.de>
References: <5b1d9cb1-509a-da7d-1361-188dfe0f21d6@wickr.com> <4BEAE096-9597-4619-ADD4-CE13E899481B@inria.fr> <CAMvzKsgMvLP5mmk8fOoTopKhFM6+EQzognv4Eq_FfMHSs9qwiA@mail.gmail.com> <5673C061-B15D-4DD2-A90C-4F179E82C31A@inria.fr> <133ba15a-037f-6a3b-182c-836b14ba233b@wickr.com> <8E87A52E-62CB-4CC0-A715-F236B03AC9E1@gmail.com> <dbe0eb1a-7a6a-4973-0951-7b6dd6f74a56@datashrine.de>
X-Mailer: Apple Mail (2.3594.4.19)
Archived-At: <https://mailarchive.ietf.org/arch/msg/mls/D8T_dKwijwTcAXXSTsnJIFpe1KU>
Subject: Re: [MLS] Re-randomized TreeKEM
X-BeenThere: mls@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Messaging Layer Security <mls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/mls>, <mailto:mls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/mls/>
List-Post: <mailto:mls@ietf.org>
List-Help: <mailto:mls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/mls>, <mailto:mls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 21 Oct 2019 12:28:07 -0000


> On Oct 21, 2019, at 2:20 PM, Konrad Kohbrok <konrad.kohbrok@datashrine.de> wrote:
> 
> Hi Karthik,
> 
> I think you got it right with regard to the additional guarantees gained by
> RTreeKEM.
> 
> Regarding your UPKE proposal: Wouldn't A then also have to send the private keys
> of each key pair to all leaves of the sub-tree blonging to the node that the key
> pair is generated for? Otherwise, only A could decrypt updates sent to those
> keys. These private keys would have to be encrypted under some previous one-time
> key that is subsequently deleted.

No, I think Karthik suggested to KDF (K=100) keypairs from the new secret (instead of K=1 today)
and immediately kill the received node secret for FS…

B.