[MLS] Delta-Remove may not be feasible

Richard Barnes <rlb@ipv.sx> Mon, 04 February 2019 22:26 UTC

MIME-Version: 1.0
From: Richard Barnes <rlb@ipv.sx>
Date: Mon, 04 Feb 2019 17:26:06 -0500
Message-ID: <CAL02cgS716Akwy5=Octnev2j_0JHoperX3Mpq3XQBcAheRYFMg@mail.gmail.com>
To: Messaging Layer Security WG <mls@ietf.org>
Content-Type: multipart/alternative; boundary="0000000000009b7019058118fb5b"
Archived-At: <https://mailarchive.ietf.org/arch/msg/mls/JQIhiT2fU_wXHPA_R6qpnKNucmo>
Subject: [MLS] Delta-Remove may not be feasible
Precedence: list

Hey all,

I was just looking at the list of open issues, in particular #104
(Sever-initated removal).  It occurred to me that we had forgotten to
record the idea (raised by EKR, me, and Yevgeniy at various times) of using
a "delta" approach to make removal more efficient.

When I sat down to try to figure out how to actually do it, I discovered
that none of the obvious approaches work with Curve25519 / Curve448!  It
turns out that the private->public mapping for those curves is not a
homomorphism with regard to addition or multiplication.  I sent a ping to
the CFRG list to see if anyone has any good ideas:

https://mailarchive.ietf.org/arch/msg/cfrg/JVg30dldjr4pcwZ1perpA1k-OGQ

Cheers,
--Richard

[MLS] Delta-Remove may not be feasible Richard Barnes