[MLS] Sending secrets in WelcomeInfo instead of keys

Michael Rosenberg <micro@fastmail.com> Wed, 07 August 2019 17:58 UTC

Return-Path: <micro@fastmail.com>
X-Original-To: mls@ietfa.amsl.com
Delivered-To: mls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9E5A6120690 for <mls@ietfa.amsl.com>; Wed, 7 Aug 2019 10:58:45 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.7
X-Spam-Level:
X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fastmail.com header.b=dC+kmXl9; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=Uib3G4Ek
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zUY19R8YNpGl for <mls@ietfa.amsl.com>; Wed, 7 Aug 2019 10:58:43 -0700 (PDT)
Received: from out4-smtp.messagingengine.com (out4-smtp.messagingengine.com [66.111.4.28]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6DAB0120284 for <mls@ietf.org>; Wed, 7 Aug 2019 10:58:43 -0700 (PDT)
Received: from compute7.internal (compute7.nyi.internal [10.202.2.47]) by mailout.nyi.internal (Postfix) with ESMTP id AE8742013C for <mls@ietf.org>; Wed, 7 Aug 2019 13:58:42 -0400 (EDT)
Received: from mailfrontend2 ([10.202.2.163]) by compute7.internal (MEProxy); Wed, 07 Aug 2019 13:58:42 -0400
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fastmail.com; h= from:content-type:content-transfer-encoding:mime-version:subject :message-id:date:to; s=fm3; bh=0aNaLHBdK0nnARasvsqcFdiryONHd4QjE 0Z1xnZE+aY=; b=dC+kmXl9iyI3vYSAT9cZsDKtCvgNLKNohRys8PF3Pjvw/K3LV h57lIkepN5cIJx+j6kT8V4XkGf2tCveGNoTPFcdUiIIATu7Q3XNVc/QOI04HbNrR OXSTb3SCCLQXeLrLt0fG2P41AJafwoOaVto23Qo2IMymSxn02yW8YwSPvlcMfz4w wsYt931LpkWEoGrc9guNsdQdEdvPhnmKPCPq2kAU4UNcKsBFu0lSpuaIE974X5k8 74b/J1Azm8jvJxRU7BD5a5m95Oh8p5AYipvMj1WGD9SctewxQ3Q3BpeXy+KinWSX Zk2JsMrmsldFe0b3qq/lxZ7l4RLiM7OdOUS6A==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-transfer-encoding:content-type :date:from:message-id:mime-version:subject:to:x-me-proxy :x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm3; bh=0aNaLH BdK0nnARasvsqcFdiryONHd4QjE0Z1xnZE+aY=; b=Uib3G4EkPF8TtmU+cLoh7o 8P+SnEg2+HbhNPVFkyf4JTfpTT8hYakqit5rq13NXo0U8j4cRZ4nIIhCfWpgckgF AmwuCt0yQPy4jEnT/aox4Y6aIeVL7IMTfE/f2gwS091mfN9R0uXvlwi+ekcUT9Xq wssN1+xg54C2SrcCGA48MOjG06XUqLbw89HJLeldPOtHsiPEj7iXRIetkZdQdr9k EuL3nNqZSjxYyDms3d2ibJHmtt/4UBOrIAZyBTvdCbmDJGQJJmJ+ENIPJI3OSBnZ ivzhDJ9a0WCO+Md6FJerWpL5YHYTnC9/6jEpifRJz+Iai0v/aEtgZYZS8IsKmamg ==
X-ME-Sender: <xms:UhFLXYox_k3kdQxVYhp8i8MdO7UduPy6UXWSCQyxEReZf8Oc-TwP7g>
X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeduvddrudduvddguddulecutefuodetggdotefrod ftvfcurfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfgh necuuegrihhlohhuthemuceftddtnecunecujfgurhephfgtgfgguffkfffvofesthhqmh dthhdtvdenucfhrhhomhepofhitghhrggvlhcutfhoshgvnhgsvghrghcuoehmihgtrhho sehfrghsthhmrghilhdrtghomheqnecukfhppedvtdegrddugeekrdegvddrudegvdenuc frrghrrghmpehmrghilhhfrhhomhepmhhitghrohesfhgrshhtmhgrihhlrdgtohhmnecu vehluhhsthgvrhfuihiivgeptd
X-ME-Proxy: <xmx:UhFLXdsOXntKvQvrGiFyC5pa7g0qTIvTMPxxX3Jp7t-NEOvlYrSN1A> <xmx:UhFLXTbT1TfMPeoVou7-3COI6WKpEsIxdAbtdbOyol5aTqKIeCMswA> <xmx:UhFLXcaPfuBH-7mxnYfFYTOM1qfEFnHNTfNvT6CBNFkkMIDFdmYC_A> <xmx:UhFLXZpK_QUfWG9c8M7Xp_yS3f-JCOds4boIuRJGDk46BDcqkMZnHw>
Received: from [192.168.7.172] (unknown [204.148.42.142]) by mail.messagingengine.com (Postfix) with ESMTPA id 2F850380075 for <mls@ietf.org>; Wed, 7 Aug 2019 13:58:42 -0400 (EDT)
From: Michael Rosenberg <micro@fastmail.com>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\))
Message-Id: <13C4667A-7D07-4E67-B762-9EF13723160C@fastmail.com>
Date: Wed, 07 Aug 2019 13:58:41 -0400
To: Messaging Layer Security WG <mls@ietf.org>
X-Mailer: Apple Mail (2.3445.104.11)
Archived-At: <https://mailarchive.ietf.org/arch/msg/mls/HiEjm-zO7zo52Vdu6hHlwXvSc48>
Subject: [MLS] Sending secrets in WelcomeInfo instead of keys
X-BeenThere: mls@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Messaging Layer Security <mls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/mls>, <mailto:mls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/mls/>
List-Post: <mailto:mls@ietf.org>
List-Help: <mailto:mls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/mls>, <mailto:mls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 07 Aug 2019 17:58:46 -0000

Problem
-------

The special-casing required to use WelcomeInfo::add_key_nonce in unframing Add messages nontrivially increases code complexity.

Framing ordinarily depends on just a handshake_secret and sender_data_secret. From those, the framer/unframer derives the handshake key/nonce and sender data key/nonce.

But in the case of an Addee processing an incoming Add, the Addee's unframer needs to be told to use the handshake key / nonce from the previous WelcomeInfo, and be told to not attempt to decrypt MLSCiphertext::encrypted_sender_data, because

1) The only reason it would need to do this is to derive the handshake key/nonce, which it already has, and
2) the Addee doesn't even know sender_data_key.

This is complex enough that it becomes hard to reason about and painful to implement.


Proposal
--------

To reduce the amount of special casing necessary, the handshake_secret and sender_data_secret be included in WelcomeInfo instead of handshake_key and handshake_nonce. This way, the only steps in the algorithm that differ between the Addee and non-Addees is where the inputs to the unframer's constructor come from, i.e., Unframer(group_ctx.handshake_secret, group_ctx.sender_data_secret) versus Unframer(welcome_info.handshake_secret, welcome_info.sender_data_secret).

Benjamin mentioned that this is technically a violation of the secrecy invariant of TreeKEM: a user who is not a member of a group at epoch n cannot know secrets from epoch n. It should be noted though that this is already violated by the existence of WelcomeInfo::init_secret and WelcomeInfo::add_key_nonce.

-Michael