[MLS] reusing HPKE keys from welcome messages

[Joel Alwen <[e-mail]>]

Hey Everyone,

Sandro Coretti and I have a few suggestions. To keep threads on the list topic
specific I'm putting the suggestions in separate emails so please excuse the
spam. Here goes.

Issue: HPKE Key Reuse
Suppose Alice (commits to a proposal that) invites Bob to a group. For this she
uses a Key Bundle for Bob with an HPKE pub key in it. That pub key has 2
functions (and correct me if I'm wrong here). On the one it becomes the HPKE key
in Bob's leaf in the new ratchet tree. On the other hand, the Welcome message to
Bob is also encrypted to that HPKE key.

Problem: Bob must keep around the corresponding HPKE secret until he updates or
leaves the group. Thing is, that same HPKE sec key lets you reprocess that
welcome message. Ergo, until he does an update we have no FS for all MLS epochs
after his join. (See PS. at end of email for more.)

Proposed Solution: Separate HPKE keys for welcome message and initial leaf key.
E.g. Key Bundles registered on the Key Server have two HPKE keys. One for the
welcome message only and the other used as new leaf's HPKE key. As soon as Bob
processes the welcome message he deletes the HPKE key he used for it.


Thoughts?

- Joël & Sandro



PS. For those familiar, this is basically a special case of the FS issues with
TreeKEM we address with RTreeKEM in eprint/2019/1189. But normally attacks on
the FS of some TreeKEM epoch msg still requires u to somehow know the previous
epochs init_secret. Thats why, normally, FS attacks on TreeKEM "only" translate
to PCFS attacks on MLS. But for the welcome message variant that's different.
The whole point of the welcome message is to bootstrap from that one HPKE secret
key all the way to full-state MLS (including current key schedule). So the
attacker no longer needs an extra init_secret if they leak that one HPKE secret
key. Thus, this goes from the usual PCFS attack for MLS to being a plain FS one.