Re: [MLS] Use Cases for avoiding Forward Secrecy

Raphael Robert <raphael@wire.com> Wed, 28 February 2018 17:31 UTC

Return-Path: <raphael@wire.com>
X-Original-To: mls@ietfa.amsl.com
Delivered-To: mls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EAD1C12D880 for <mls@ietfa.amsl.com>; Wed, 28 Feb 2018 09:31:31 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.935
X-Spam-Level:
X-Spam-Status: No, score=-1.935 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_SOFTFAIL=0.665] autolearn=no autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=wire-com.20150623.gappssmtp.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id G3UlYllnO2CB for <mls@ietfa.amsl.com>; Wed, 28 Feb 2018 09:31:30 -0800 (PST)
Received: from mail-wm0-x233.google.com (mail-wm0-x233.google.com [IPv6:2a00:1450:400c:c09::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2356E1243FE for <mls@ietf.org>; Wed, 28 Feb 2018 09:31:30 -0800 (PST)
Received: by mail-wm0-x233.google.com with SMTP id 188so6569478wme.1 for <mls@ietf.org>; Wed, 28 Feb 2018 09:31:30 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=wire-com.20150623.gappssmtp.com; s=20150623; h=from:content-transfer-encoding:mime-version:subject:date:references :to:in-reply-to:message-id; bh=xoYxmdjEvyy9JvBM+3Ur15QJYI2SwJW2qIBl/YxsWK4=; b=0QRwZcFPp7bP1o1h74DktJHYziFr/okZPa4B3S79aMuNbEYX4kbZp4adtvi1KcCVbE 3nLX9gpCnYE82au2K9uhcmGMmrkOvCj1ZY5ZDnFNMrVe+YHzC5BRy2X7AkWUgyzCNyKq gLkCOUt1BJ8A+ETr+X058WogGzS59ARog+bl0ejLzGj6a8gM7eoZa5RFFnjAuKiQwvtu u+X1O/vHqDFffhoG/2lehPvHqQOlFRQ3W3AVOgANk1pNTxzQmYkFuxmmcT+aXL6rc3K/ GxzAoqzg03OuL8SiNlSwkjSgN+7u6t/Eyy2IvxtPpzRgps3y8qrQp1AI9aL82umVQooz y7Yw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:content-transfer-encoding:mime-version :subject:date:references:to:in-reply-to:message-id; bh=xoYxmdjEvyy9JvBM+3Ur15QJYI2SwJW2qIBl/YxsWK4=; b=APyle/7Rrz6uO8lMkdM/gkVkG1liPa8U0FvhSJV6HGxRIcFiQ5vhI7jkWBOgbImo+u XRv9owULajncs1UGG2Tx0N7B5tvI1Jpi9bDRoZ97YRzsRxfyq+7cYxLuhYpU42j6hMsg PGnEpg7r4dqbr3HdpuJRhbwB4Umv0J1RdFqACBsHEkSECMl+INsfob717DCiBv7MgrJf JkBs9Gzy6/PInrrEKOxbSzNwF14PrxN7k07PCmQng8jDJ1n5tygHx978CXKzk/OUzyjY vMb/Gg9S950HD0twYCnbBGkPmVFqcxWJCCY3Qu7v4YZlFa4VWpTvxeijt6++WI90xs85 k0hw==
X-Gm-Message-State: APf1xPDmC6y9hd2PT44IKisyes7ytQYW7l8AmGelM42mjIJDitQdrdrM Z/yd/le0mBYh6S+/2RGM742aoyLEaFQ=
X-Google-Smtp-Source: AG47ELspdeYYINlZpYnzsr7h/8eGXDp1ckHPNTBLUF/D04rJx3EfsP1s1GzHE0eKXEkRF8zc+ZWULA==
X-Received: by 10.28.153.133 with SMTP id b127mr13964347wme.105.1519839088015; Wed, 28 Feb 2018 09:31:28 -0800 (PST)
Received: from rmbp.wire.local (h-62.96.148.44.host.de.colt.net. [62.96.148.44]) by smtp.gmail.com with ESMTPSA id g52sm4617109wra.20.2018.02.28.09.31.26 for <mls@ietf.org> (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 28 Feb 2018 09:31:26 -0800 (PST)
From: Raphael Robert <raphael@wire.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Mime-Version: 1.0 (Mac OS X Mail 11.2 \(3445.5.20\))
Date: Wed, 28 Feb 2018 18:31:25 +0100
References: <CAKHUCzxOwmPrpUUj6HSRMcxiXtRmT05OapeBQdRA49bSWum6yQ@mail.gmail.com>
To: mls@ietf.org
In-Reply-To: <CAKHUCzxOwmPrpUUj6HSRMcxiXtRmT05OapeBQdRA49bSWum6yQ@mail.gmail.com>
Message-Id: <33211538-1DA2-4B42-A3BD-A6AD248C907A@wire.com>
X-Mailer: Apple Mail (2.3445.5.20)
Archived-At: <https://mailarchive.ietf.org/arch/msg/mls/QujjYMRlVOabPsspocJLbbPivWY>
Subject: Re: [MLS] Use Cases for avoiding Forward Secrecy
X-BeenThere: mls@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: Messaging Layer Security <mls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/mls>, <mailto:mls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/mls/>
List-Post: <mailto:mls@ietf.org>
List-Help: <mailto:mls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/mls>, <mailto:mls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 28 Feb 2018 17:31:32 -0000

Hi Dave,

Mandatory retention and UX are valid points of course. The scope of MLS is however to provide strong security guarantees like FS on the other hand. Re-using the same encryption key is something applications that use MLS can on the layer above the messaging protocol: the “application layer”. This would allow application developers to take that decision independently for the specific use cases they want to cater for.

Raphael

> On 28 Feb 2018, at 18:14, Dave Cridland <dave@cridland.net> wrote:
> 
> Hi folks,
> 
> While I'm really pleased to see MLS, and I generally like the idea of
> Forward Secrecy, there's a couple of use cases where it might be worth
> avoiding. Feel free to correct me if these are in fact possible with
> Forward Secrecy. Both these relate to archival access to past
> messages:
> 
> * UX - Some users (actually all of them) would like to be able to
> install client software on a new device and have their historical
> messages available to them. Most "business" messaging systems seem to
> work this way, as well as a number of consumer-grade systems. The
> nature of Forward Secrecy means that an archive would need to be held
> on one device and re-sent to another through the network, which is
> trickier to manage, and is reliant on multiple devices being online at
> overlapping times. Alternately, the archival copy might be re-uploaded
> to the server using a static encryption key, I suppose, which would
> rather spoil the point.
> 
> * Retention - Many business and government deployments have mandatory
> retention requirements. An example is MIKEY-SAKKE, promoted in part by
> the UK Government for its own communications, which uses mandatory key
> escrow to keep an archived copy of the messages accessible to the
> business units involved. An advantage of the SAKKE system is that it
> allows the key escrow to be offline, limiting attack opportunities.
> 
> Given the latter, for example, I could not use an MLS-based system to
> discuss a tax problem with the authority, and since I'm unlikely to
> have a SAKKE-based messaging client, I'm unlikely to have encrypted
> messaging to my tax authority at all - which seems signficantly worse
> than merely having no Forward Secrecy.
> 
> None of this is to say that Forward Secrecy should be avoided
> entirely, of course.
> 
> Dave.
> 
> _______________________________________________
> MLS mailing list
> MLS@ietf.org
> https://www.ietf.org/mailman/listinfo/mls