Re: [MLS] Use Cases for avoiding Forward Secrecy

[Dave Cridland <[e-mail]>]

On 1 March 2018 at 16:59, Jon Millican <[e-mail]> wrote:
> If the question is about whether MLS should support forward secrecy in the
> first place, I think consumer E2E messaging applications provide a good use
> case for this. The threat model that we tend to take here is that the user
> has limited trust in the service provider. In this situation, the security
> properties provided by TLS are almost moot, as TLS only protects you as far
> as the service provider anyway.

Well, I think TLS is important too - it's usually protecting metadata
from third parties to a reasonable degree.

> Ephemerality is a very common property in such apps, with the explicit goal
> that messages not be accessible after a certain period. Even without
> ephemerality, I believe that most messaging support message deletion. In
> such situations, forward secrecy is very desirable, as it ensures that if
> keys or any device state do leak at any moment (be it from an exploit,
> somebody imaging a device, or a temporary bug in the app itself), users’ old
> messages can at least remain secret, even if the provider had retained all
> of their ciphertexts. This also leads to a similar case for Post-Compromise
> Security, in that secrecy can be recovered even after any sort of key
> leakage: although in this case the argument applies even when no messages
> are ever deleted.

And yes, I totally agree with everything you've said here, which can
be summarised as "FS is important in consumer-grade messaging".

But:

* A verifiable record is more-or-less mandated by Government.
* A verifiable record is generally relied upon by consumer service companies.
* A (non-verifiable) record is used in most enterprise messaging
applications, and many consumer grade.
* Consumers sometimes talk to consumer service companies and Governments.

Again, I'd make it clear I am not arguing that Forward Secrecy should
never be available - I'm arguing that in some cases it may not be an
acceptable option, and in such cases if the options are between
non-viable (but good) security and no security at all, then people
will simply choose another option (like a bespoke messaging platform
for enterprise/consumer).

That feels like a missed opportunity.

Dave.