Re: [MLS] Deniability -> "recording"?

[Benjamin Beurdouche <[e-mail]>]

> We can work around the PFS by (in effect) using MLS as a groupwise key exchange protocol and exporting a longer term key for message encryption, but if we destroy cryptographic integrity post-facto, as I assume we mean by deniability, then that makes life increasingly unpleasant for the cases where people actually want different properties.
> 
> In short, preventing various groups making use of MLS is not security first.

In general, I don’t see deniability and authentication as such a strong opposition.

But anyway, MLS is currently at a sweet spot in terms of design:
As a default, because we have such a variety of use cases for the protocol, the authentication
service is responsible for the biding between an identity and the signature key which is used
by the protocol to authenticate members whether it is in a deniable way or not.

The authors and collaborators of the working group are gonna carefully document
each security tradeoffs in the architecture document, but ultimately, since each provider
has the ability to tune the exact way to provide and verify these signing keys, I think there
is no concern to have overall. We will remain careful to allow all these use cases...

B.